Vulnerability-Lookup

CVE-2026-73428 (GCVE-0-2026-73428)

Vulnerability from cvelistv5 – Published: 2026-08-13 22:04 – Updated: 2026-08-14 18:06

Title

Trix: Stored XSS via HTMLParser attribute injection on paste

Summary

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span>` with an empty `data-trix-attachment="{}"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.

Severity

4.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 17:39 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/basecamp/trix/security/advisor…	x_refsource_CONFIRM
https://github.com/basecamp/trix/pull/1293	x_refsource_MISC
https://github.com/basecamp/trix/commit/9c0a993d9…	x_refsource_MISC
https://github.com/basecamp/trix/releases/tag/v2.1.18	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
basecamp	trix	Affected: < 2.1.18

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73428",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T17:39:35.455077Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T18:06:36.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "trix",
          "vendor": "basecamp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `\u003cspan\u003e` with an empty `data-trix-attachment=\"{}\"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T22:04:19.121Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3"
        },
        {
          "name": "https://github.com/basecamp/trix/pull/1293",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/basecamp/trix/pull/1293"
        },
        {
          "name": "https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c"
        },
        {
          "name": "https://github.com/basecamp/trix/releases/tag/v2.1.18",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/basecamp/trix/releases/tag/v2.1.18"
        }
      ],
      "source": {
        "advisory": "GHSA-53g2-mvcc-q9x3",
        "discovery": "UNKNOWN"
      },
      "title": "Trix: Stored XSS via HTMLParser attribute injection on paste"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73428",
    "datePublished": "2026-08-13T22:04:19.121Z",
    "dateReserved": "2026-08-12T14:32:11.796Z",
    "dateUpdated": "2026-08-14T18:06:36.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73428",
      "date": "2026-10-03",
      "epss": "0.00353",
      "percentile": "0.26706"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "trix",
                "vendor": "basecamp",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.1.18"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `\u003cspan\u003e` with an empty `data-trix-attachment=\"{}\"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18."
          }
        ],
        "id": "CVE-2026-73428",
        "lastModified": "2026-09-18T20:09:01.757",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.6,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.1,
              "impactScore": 2.5,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-73428",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T17:39:35.455077Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-13T22:17:26.587",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/basecamp/trix/pull/1293"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/basecamp/trix/releases/tag/v2.1.18"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-08-14T14:00:43+00:00",
      "cve": "CVE-2026-73428",
      "id": "CVE-2026-73428",
      "initial_release_date": "2026-08-13T22:04:19.121000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "trix: action_text-trix: Trix: Stored Cross-Site Scripting via HTML paste allows arbitrary code execution.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73428.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-73428",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-14T17:39:35.455077Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-14T17:39:36.696Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "trix",
              "vendor": "basecamp",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.1.18"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `\u003cspan\u003e` with an empty `data-trix-attachment=\"{}\"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.6,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-13T22:04:19.121Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3"
            },
            {
              "name": "https://github.com/basecamp/trix/pull/1293",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/basecamp/trix/pull/1293"
            },
            {
              "name": "https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c"
            },
            {
              "name": "https://github.com/basecamp/trix/releases/tag/v2.1.18",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/basecamp/trix/releases/tag/v2.1.18"
            }
          ],
          "source": {
            "advisory": "GHSA-53g2-mvcc-q9x3",
            "discovery": "UNKNOWN"
          },
          "title": "Trix: Stored XSS via HTMLParser attribute injection on paste"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-73428",
        "datePublished": "2026-08-13T22:04:19.121Z",
        "dateReserved": "2026-08-12T14:32:11.796Z",
        "dateUpdated": "2026-08-14T18:06:36.864Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-352820

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 08:21

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T08:21:32.278584+00:00",
  "id": "EUVD-2026-352820"
}

FKIE_CVE-2026-73428

Vulnerability from fkie_nvd - Published: 2026-08-13 22:17 - Updated: 2026-09-18 20:09

Severity

4.6 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c
	security-advisories@github.com	https://github.com/basecamp/trix/pull/1293
	security-advisories@github.com	https://github.com/basecamp/trix/releases/tag/v2.1.18
	security-advisories@github.com	https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "trix",
          "vendor": "basecamp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.18"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `\u003cspan\u003e` with an empty `data-trix-attachment=\"{}\"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18."
    }
  ],
  "id": "CVE-2026-73428",
  "lastModified": "2026-09-18T20:09:01.757",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73428",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-14T17:39:35.455077Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-13T22:17:26.587",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/basecamp/trix/pull/1293"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/basecamp/trix/releases/tag/v2.1.18"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-53G2-MVCC-Q9X3

Vulnerability from github – Published: 2026-07-24 16:18 – Updated: 2026-08-12 20:52

Summary

Trix: Stored XSS via HTMLParser attribute injection on paste

Details

Impact

The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The HTMLParser processed a mock attachment, a <span> carrying an empty data-trix-attachment="{}". The empty attachment object caused the element to bypass attachment handling, so its data-trix-attributes were applied to a plain string piece. The pre-2.1.18 StringPiece.fromJSON accepted the href without validation, so an attacker-supplied javascript: URI was carried into the document model and emitted verbatim into the serialized HTML, executing when the content was rendered and clicked.

This is a stored XSS in any application that accepts untrusted rich text through Trix and renders the serialized output to other users. Applications that apply server-side HTML sanitization, such as the Rails built-in sanitizer, are additionally protected because the payload is neutralized on save.

This vulnerability shares its fix with GHSA-53p3-c7vp-4mcc. Both are resolved by the StringPiece.fromJSON sanitization added in 2.1.18. This advisory covers the paste and HTMLParser entry vector, while GHSA-53p3-c7vp-4mcc covers the drag-and-drop path through the fallback Level0InputController.

Patches

Users should upgrade to Trix editor version 2.1.18 or later.

References

The vulnerability was responsibly reported by HackerOne researcher newbiefromcoma.

Severity

4.6 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "trix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "action_text-trix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73428"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T16:18:01Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The `HTMLParser` processed a mock attachment, a `\u003cspan\u003e` carrying an empty `data-trix-attachment=\"{}\"`. The empty attachment object caused the element to bypass attachment handling, so its `data-trix-attributes` were applied to a plain string piece. The pre-2.1.18 `StringPiece.fromJSON` accepted the `href` without validation, so an attacker-supplied `javascript:` URI was carried into the document model and emitted verbatim into the serialized HTML, executing when the content was rendered and clicked.\n\nThis is a stored XSS in any application that accepts untrusted rich text through Trix and renders the serialized output to other users. Applications that apply server-side HTML sanitization, such as the Rails built-in sanitizer, are additionally protected because the payload is neutralized on save.\n\nThis vulnerability shares its fix with GHSA-53p3-c7vp-4mcc. Both are resolved by the `StringPiece.fromJSON` sanitization added in 2.1.18. This advisory covers the paste and HTMLParser entry vector, while GHSA-53p3-c7vp-4mcc covers the drag-and-drop path through the fallback Level0InputController.\n\n### Patches\n\nUsers should upgrade to Trix editor version 2.1.18 or later.\n\n### References\n\nThe vulnerability was responsibly reported by HackerOne researcher [newbiefromcoma](https://hackerone.com/newbiefromcoma).",
  "id": "GHSA-53g2-mvcc-q9x3",
  "modified": "2026-08-12T20:52:01Z",
  "published": "2026-07-24T16:18:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/basecamp/trix"
    },
    {
      "type": "WEB",
      "url": "https://github.com/basecamp/trix/releases/tag/v2.1.18"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Trix: Stored XSS via HTMLParser attribute injection on paste"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-73428 (GCVE-0-2026-73428)

EUVD-2026-352820

FKIE_CVE-2026-73428

GHSA-53G2-MVCC-Q9X3

Impact

Patches

References

Tags

Sightings

Nomenclature

Related by attack behaviour