CVE-2026-73428 basecamp CVE debrief

Who should care

Defenders responsible for maintaining and securing applications that use the Trix rich text editor should assess their exposure and prioritize updating to version 2.1.18 or applying server-side HTML sanitization.

Why it matters

A stored cross-site scripting vulnerability in Trix allows an attacker to inject malicious JavaScript code, which can be executed when another user interacts with the content. Defenders should prioritize updating Trix or applying server-side HTML sanitization to prevent the execution of malicious code.

• Execution of malicious JavaScript code when another user renders and clicks the content
• Potential for data theft or unauthorized actions
• Defensive priority for updating Trix or applying server-side HTML sanitization
• Verification of Trix version and server-side HTML sanitization configuration

Technical summary

The vulnerability occurs when crafted HTML is pasted into the Trix editor, allowing an attacker to inject malicious JavaScript code. This code can be executed when another user renders and clicks the content. The issue is fixed in version 2.1.18. The vulnerability is caused by the HTMLParser processing a mock attachment in a <span> with an empty data-trix-attachment={} value, leading to the application of data-trix-attributes to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML. Defenders should prioritize updating Trix to version 2.1.18 or applying server-side HTML sanitization to prevent the execution of malicious

Defensive priority

Defenders should prioritize updating Trix to version 2.1.18 or applying server-side HTML sanitization to prevent the execution of malicious code.

Recommended defensive actions

• Update Trix to version 2.1.18 or later
• Apply server-side HTML sanitization to neutralize the payload on save
• Review and update any applications using Trix to ensure they are using the latest version
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the HTMLParser processing a mock attachment in a <span> with an empty data-trix-attachment={} value, leading to the application of data-trix-attributes to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.