CVE-2026-73428: 
JavaScript vulnerability analysis and mitigation

CVE-2026-73428 is a stored cross-site scripting (XSS) vulnerability in the Trix WYSIWYG rich text editor (by Basecamp) that allows authenticated attackers to inject and store malicious JavaScript via crafted HTML pasted into the editor. It affects all Trix versions prior to 2.1.18 (both the trix npm package and the action_text-trix RubyGems package). The vulnerability was responsibly disclosed by HackerOne researcher newbiefromcoma and the advisory was published on July 9, 2026, with a fix released on March 26, 2026 (v2.1.18). It carries a CVSS v3.1 base score of 4.6 (Medium) (GitHub Advisory).

The root cause is improper input validation (CWE-79) in Trix's HTMLParser and StringPiece.fromJSON components. When crafted HTML containing a <span> element with an empty data-trix-attachment="{}" attribute is pasted into the editor, the empty attachment object bypasses attachment handling, causing data-trix-attributes to be applied to a plain StringPiece instead. Because StringPiece.fromJSON accepted href values without validation, an attacker-supplied javascript: URI was carried verbatim into the document model and emitted into the serialized HTML output. The payload executes when another user renders the content and clicks the injected link. This advisory (GHSA-53g2-mvcc-q9x3) covers the paste/HTMLParser entry vector; a related advisory (GHSA-53p3-c7vp-4mcc) covers the same StringPiece.fromJSON flaw via drag-and-drop through Level0InputController, both fixed by the same sanitization patch (GitHub Advisory, Fix Commit).

Successful exploitation enables stored XSS in any application that accepts untrusted rich text through Trix and renders the serialized output to other users. An attacker with low-privileged access (e.g., a regular application user) can store a malicious javascript: URI payload that executes in the browser context of any victim who views and clicks the content, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. Confidentiality and integrity are both impacted at a low level per CVSS; availability is not affected. Applications using server-side HTML sanitization (such as the Rails built-in sanitizer) receive additional protection because the payload is neutralized on save (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The EPSS score is 0.0, indicating very low current probability of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker (low privileges) and victim user interaction (clicking a crafted link), limiting the practical attack surface (GitHub Advisory, Feedly).

1. Gain access: Obtain a low-privileged account on a target application that uses Trix for rich text editing (e.g., a Rails app with Action Text).
2. Craft malicious HTML: Construct an HTML snippet containing a <span> element with an empty data-trix-attachment="{}" attribute and a data-trix-attributes value that includes a javascript: URI as the href, for example: <span data-trix-attachment="{}" data-trix-attributes='{"href":"javascript:alert(document.cookie)"}'> Click me </span>.
3. Paste into editor: Copy the crafted HTML to the clipboard and paste it into a Trix editor field in the vulnerable application. The HTMLParser processes the mock attachment and applies the data-trix-attributes (including the malicious href) to a plain StringPiece without validation.
4. Store the payload: Submit the form or save the content. The javascript: URI is serialized verbatim into the stored HTML output.
5. Trigger execution: When another user (victim) views the page containing the stored content and clicks the rendered link, the javascript: URI executes in their browser context, enabling session theft, credential harvesting, or other client-side attacks (GitHub Advisory, Fix Commit).

• Application Logs: Requests saving rich text content containing data-trix-attachment="{}" combined with data-trix-attributes values that include javascript: URIs in the href field.
• Database/Storage: Stored HTML content containing <a href="javascript:..." or <span data-trix-attributes='{"href":"javascript: patterns in Trix-managed fields.
• Network: Unexpected outbound requests from victim browsers to attacker-controlled domains following interaction with Trix-rendered content (indicative of XSS payload execution such as cookie exfiltration).
• Browser Console: JavaScript errors or unexpected alert() dialogs triggered when users click links in Trix-rendered content (GitHub Advisory).

Upgrade Trix to version 2.1.18 or later (both the trix npm package and action_text-trix RubyGem), which adds a DOMPurify.isValidAttribute check in StringPiece.fromJSON to strip invalid href values at deserialization time (GitHub Release, Fix Commit). As a compensating control, applications that apply server-side HTML sanitization (e.g., Rails' built-in ActionView::Helpers::SanitizeHelper) are additionally protected because the javascript: payload is neutralized before storage. Upgrading to the patched version is the recommended and definitive remediation (GitHub Advisory).

The vulnerability was responsibly reported to Basecamp via HackerOne by researcher newbiefromcoma and was addressed promptly with a coordinated disclosure. The fix was developed and merged by Basecamp maintainer flavorjones (Mike Dalessio) on March 26, 2026, with the advisory published on July 9, 2026. No significant broader media coverage or notable community controversy has been observed beyond the standard advisory and release notes (GitHub Advisory, GitHub Release).