CVE-2026-73428: 
JavaScript Análise e mitigação de vulnerabilidades

CVE-2026-73428 is a stored cross-site scripting (XSS) vulnerability in the Trix WYSIWYG rich text editor, affecting all versions prior to 2.1.18 (both the trix npm package and the action_text-trix RubyGems package by Basecamp). The flaw allows an authenticated attacker to paste crafted HTML into the editor, injecting a javascript: URI that persists in the document model and executes in the browser of any user who later renders and clicks the content. The vulnerability was responsibly disclosed by HackerOne researcher newbiefromcoma, published on August 13, 2026, and fixed in version 2.1.18 released March 26, 2026. It carries a CVSS v3.1 base score of 4.6 (Medium) (GitHub Advisory, Red Hat).

The root cause is improper input neutralization (CWE-79) in Trix's HTMLParser and StringPiece.fromJSON components. When crafted HTML containing a <span> with an empty data-trix-attachment="{}" attribute is pasted into the editor, the parser treats it as a mock attachment; because the attachment object is empty, attachment handling is bypassed and data-trix-attributes are instead applied to a plain StringPiece. The pre-2.1.18 StringPiece.fromJSON method accepted the href attribute from the parsed JSON without any validation, allowing an attacker-supplied javascript: URI to propagate into the document model and be emitted verbatim into the serialized HTML output. The payload executes when a victim user renders the content and clicks the injected link. A related vector (GHSA-53p3-c7vp-4mcc) covers the same StringPiece.fromJSON flaw triggered via drag-and-drop through Level0InputController, and both are resolved by the same fix (GitHub Advisory, Fix Commit).

Successful exploitation enables arbitrary JavaScript execution in the browser of any user who views and clicks the malicious content, making this a stored XSS with a persistent, multi-victim attack surface. Potential consequences include session hijacking, credential theft, account takeover, and unauthorized actions performed on behalf of the victim within the application. Confidentiality and integrity are both partially impacted; availability is not affected. Applications using server-side HTML sanitization (e.g., the Rails built-in sanitizer) are additionally protected, as the payload is neutralized at save time (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.0017 (0.17%), indicating a low probability of exploitation in the near term. Exploitation requires the attacker to have at least low-level privileges (i.e., the ability to paste content into a Trix editor) and requires user interaction from a victim (clicking the injected link). The vulnerability is not automatable and has not been added to the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Identify a target application: Locate a web application that uses Trix editor (versions < 2.1.18) and allows authenticated users to create or edit rich text content that is subsequently rendered to other users.
2. Craft the malicious HTML payload: Construct an HTML snippet containing a <span> element with an empty data-trix-attachment="{}" attribute and a data-trix-attributes value that includes a javascript: URI as the href, for example:

   <span data-trix-attachment="{}" data-trix-attributes='{"href":"javascript:alert(document.cookie)"}'>
     Click me
   </span>

3. Paste the payload into the editor: Copy the crafted HTML to the clipboard and paste it into the Trix editor. The HTMLParser processes the mock attachment, bypasses attachment handling, and applies the data-trix-attributes (including the malicious href) to a plain StringPiece.
4. Save the content: Submit or save the content. The javascript: URI is serialized verbatim into the stored HTML output. Applications without server-side sanitization will persist the payload.
5. Trigger execution on a victim: When another user views the page containing the stored content and clicks the injected link, the javascript: URI executes arbitrary JavaScript in their browser context, enabling session token theft, credential harvesting, or further attacks (GitHub Advisory, Fix Commit).

• Logs: Web server or application logs showing POST requests to content-save endpoints containing data-trix-attachment or data-trix-attributes fields with javascript: URI patterns in the body.
• Database / Stored Content: Persisted rich text fields containing <span> elements with data-trix-attachment="{}" and href values beginning with javascript: (including obfuscated variants such as JavaScript:, javascript:, or whitespace-padded forms like javascript:).
• Network: Outbound requests from victim browsers to attacker-controlled infrastructure (e.g., cookie-stealing endpoints) originating from pages that render Trix content.
• Browser / Client-Side: Unexpected JavaScript execution events (e.g., alert, fetch, or XMLHttpRequest calls) triggered by user click events on links within Trix-rendered content.

Upgrade the trix npm package or action_text-trix RubyGems package to version 2.1.18 or later, which adds a DOMPurify.isValidAttribute check in StringPiece.fromJSON to strip invalid href values (including javascript: URIs) at deserialization time (Trix Release, Fix Commit). As a defense-in-depth measure, enable server-side HTML sanitization (e.g., the Rails built-in sanitizer via ActionText) to neutralize any persisted payloads at save time — this mitigates the impact even on unpatched versions (GitHub Advisory). There is no known configuration-only workaround that fully prevents the client-side injection without upgrading.

The vulnerability was responsibly reported to Basecamp via HackerOne by researcher newbiefromcoma and was addressed promptly with a patch in version 2.1.18. Red Hat tracked the issue via Bugzilla (Bug 2515813) and assigned it medium severity, reflecting its limited scope and the availability of server-side mitigations (Red Hat Bugzilla). No significant broader media coverage or notable public researcher commentary beyond the official advisory has been observed.