CVE-2026-73426: 
JavaScript vulnerability analysis and mitigation

CVE-2026-73426 is a stored Cross-Site Scripting (XSS) vulnerability in the Trix WYSIWYG rich text editor, affecting all versions prior to 2.1.17. The flaw allows an attacker to craft HTML containing a data-trix-serialized-attributes attribute that bypasses the DOMPurify sanitizer, enabling arbitrary JavaScript execution in a victim's browser session. It affects both the npm package trix and the RubyGems package action_text-trix. The vulnerability was responsibly disclosed via HackerOne (report #3581911) and patched on March 11, 2026. It carries a CVSS v3.1 base score of 4.6 (Medium) (GitHub Advisory).

The root cause (CWE-79) lies in how Trix's DOMPurify integration handled the data-trix-* attribute namespace. The existing uponSanitizeAttribute hook used a broad forceKeepAttr = true rule to preserve all data-trix-* attributes, but failed to exclude data-trix-serialized-attributes — the only attribute in that namespace whose value is later expanded into arbitrary DOM attributes via el.setAttribute(name, value) in the serialization code. An attacker with low privileges can craft and submit HTML (e.g., via paste or stored content) containing a data-trix-serialized-attributes payload embedded within a data-trix-attachment JSON structure. When the content is rendered, the serializer reads the attribute value as trusted instructions and sets attacker-controlled attributes (such as onerror) on DOM elements, triggering JavaScript execution. The attack requires user interaction (a victim viewing the malicious content) (GitHub Advisory, Fix PR).

Successful exploitation allows an attacker to execute arbitrary JavaScript within the context of the victim user's browser session on the affected application. This can lead to unauthorized actions performed on behalf of the victim, session token theft, credential harvesting, or disclosure of sensitive information accessible to the user. The availability impact is none, but both confidentiality and integrity are partially compromised. Applications using Trix for user-generated content (e.g., Rails apps with ActionText) are at risk if they render untrusted content from other users (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The NVD SSVC assessment indicates exploitation is "none" and the attack is not automatable, as it requires user interaction (a victim must view the attacker-crafted content). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was responsibly reported by a HackerOne researcher identified as "newbiefromcoma" (GitHub Advisory).

1. Identify a target application: Find a web application using Trix editor (npm trix < 2.1.17 or RubyGems action_text-trix < 2.1.17) that renders user-supplied rich text content to other users.
2. Craft a malicious payload: Construct an HTML snippet containing a data-trix-attachment attribute whose JSON value includes a nested data-trix-serialized-attributes attribute with a malicious payload, for example embedding an onerror event handler on an <img> element.
3. Inject the payload: Submit or paste the crafted HTML into the Trix editor on the target application (e.g., a comment field, document editor, or message composer). Because the data-trix-serialized-attributes attribute was not stripped by DOMPurify in vulnerable versions, it is stored as-is.
4. Trigger victim rendering: Wait for or social-engineer a victim user to view the page containing the stored malicious content.
5. JavaScript execution: When the Trix serializer processes the stored content, it reads data-trix-serialized-attributes as trusted instructions and calls el.setAttribute() with attacker-controlled attribute names and values (e.g., onerror="alert(document.cookie)"), executing arbitrary JavaScript in the victim's session (Fix PR, GitHub Advisory).

• Logs: Web server or application logs showing POST requests to content submission endpoints containing data-trix-serialized-attributes in the request body, particularly with encoded event handler strings (e.g., onerror, onload).
• File System / Database: Stored rich text content in the database containing the string data-trix-serialized-attributes with embedded JavaScript event handlers or encoded script payloads.
• Network: Outbound requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) originating from pages that render Trix editor content.
• Browser / Client-Side: Unexpected JavaScript execution or network requests triggered when viewing Trix-rendered content, observable via browser developer tools or Content Security Policy (CSP) violation reports.

Upgrade the Trix editor to version 2.1.17 or later for both the npm package (trix) and the RubyGems package (action_text-trix). The fix adds an explicit check in the DOMPurify uponSanitizeAttribute hook to strip data-trix-serialized-attributes before the broad data-trix-* force-keep logic runs, preventing the attribute from reaching the serialization sink. No configuration-based workaround is available for unpatched versions; upgrading is the only remediation. Applications using Rails ActionText should update the action_text-trix gem accordingly (GitHub Release, Fix Commit).

The vulnerability was responsibly disclosed through HackerOne and patched promptly by the Trix maintainer (flavorjones) on March 11, 2026. The fix underwent an AI-assisted code review (Claude and Codex) as part of the pull request process, which confirmed no bypass potential and low regression risk. The release was noted in downstream dependency update PRs (e.g., in the DFE-Digital project). No significant broader media coverage or notable researcher commentary beyond the GitHub advisory and PR discussion has been identified (GitHub Advisory, Fix PR).