CVE-2026-73428

Katalog CVE

CVSS 4.6 · Medium EPSS 0,35%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Skor CVSS 3.1 4.6 (Medium) menurut github.com.

Deskripsi (NVD)

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span>` with an empty `data-trix-attachment="{}"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

18 September 2026

Status NVD

Deferred

CVSS 3.1

4.6 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 27,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c
• https://github.com/basecamp/trix/pull/1293
• https://github.com/basecamp/trix/releases/tag/v2.1.18
• https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3