CVE-2026-73426 is a medium-severity (CVSS 4.6) Cross-site Scripting (XSS) vulnerability in trix. A fix is available for trix — see the affected versions and patch details below.
Trix: Stored XSS vulnerability through serialized attributes
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-73426 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 379,842 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
trixnpmDescription
Impact
The Trix editor, in versions prior to 2.1.17, is vulnerable to XSS attacks when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer.
An attacker could craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when the content is rendered, could execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.
Patches
Update Recommendation: Users should upgrade to Trix editor version 2.1.17 or later.
References
The XSS vulnerability was responsibly reported by Hackerone researcher newbiefromcoma.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | trix | all versions | 2.1.17npm install trix@2.1.17 |
| 💎RubyGems | action_text-trix | all versions | 2.1.17bundle update action_text-trix --conservative |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for trix, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update trix to 2.1.17 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-73426 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
A stored cross-site scripting (XSS) vulnerability was found in Trix, a rich text editor for web applications. In versions prior to 2.1.17, a custom DOMPurify hook permits the data-trix-serialized-attributes attribute to bypass sanitization. Trix later parses this attribute and applies its contents to the DOM without…
Red Hat products are not affected by this vulnerability as they ship Trix editor version 2.1.17 or later, which includes the fix for this issue. No action is required for Red Hat product users. For customers who may be using Trix editor independently in custom applications or integrations outside of Red Hat products, ensure that the Trix npm package or action_text-trix RubyGem is upgraded to version 2.1.17 or later. After upgrading, review any stored content that may have been created with vulnerable versions of Trix to ensure it does not contain malicious serialized attributes. Consider implementing Content Security Policy (CSP) headers to provide an additional layer of defense against XSS…Source: Red Hat security advisory for CVE-2026-73426 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2026-73426 in your dependencies?
Find it across npm, RubyGems, including transitive dependencies.