https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T23:34:50.569353+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-352820 EUVD-2026-352820 2026-10-05T23:34:50.618595+00:00 EUVD-2026-352820 https://cve.radiocsirt.org/vuln/fkie_cve-2026-73428 fkie_cve-2026-73428 2026-10-05T23:34:50.618633+00:00

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span>` with an empty `data-trix-attachment="{}"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.

 https://cve.radiocsirt.org/vuln/ghsa-53g2-mvcc-q9x3 GHSA-53g2-mvcc-q9x3 — Trix: Stored XSS via HTMLParser attribute injection on paste 2026-10-05T23:34:50.618673+00:00

Affected: npm: trix, RubyGems: action_text-trix

### Impact

The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The `HTMLParser` processed a mock attachment, a `<span>` carrying an empty `data-trix-attachment="{}"`. The empty attachment object caused the element to bypass attachment handling, so its `data-trix-attributes` were applied to a plain string piece. The pre-2.1.18 `StringPiece.fromJSON` accepted the `href` without validation, so an attacker-supplied `javascript:` URI was carried into the document model and emitted verbatim into the serialized HTML, executing when the content was rendered and clicked.

This is a stored XSS in any application that accepts untrusted rich text through Trix and renders the serialized output to other users. Applications that apply server-side HTML sanitization, such as the Rails built-in sanitizer, are additionally protected because the payload is neutralized on save.

This vulnerability shares its fix with GHSA-53p3-c7vp-4mcc. Both are resolved by the `StringPiece.fromJSON` sanitization added in 2.1.18. This advisory covers the paste and HTMLParser entry vector, while GHSA-53p3-c7vp-4mcc covers the drag-and-drop path through the fallback Level0InputController.

### Patches

Users should upgrade to Trix editor version 2.1.18 or later.

### References

The vulnerability was responsibly reported by HackerOne researcher [newbiefromcoma](https://hackerone.com/newbiefromcoma).