CVE-2026-73426
Description
A flaw was found in Trix, a rich text editor. An attacker can exploit a cross-site scripting (XSS) vulnerability by crafting malicious HTML with a data-trix-serialized-attributes attribute. This attribute can bypass the DOMPurify sanitizer, allowing the execution of arbitrary JavaScript in a user's session. This could lead to unauthorized actions or the disclosure of sensitive information.
Statement
A stored cross-site scripting (XSS) vulnerability was found in Trix, a rich text editor for web applications. In versions prior to 2.1.17, a custom DOMPurify hook permits the data-trix-serialized-attributes attribute to bypass sanitization. Trix later parses this attribute and applies its contents to the DOM without proper validation. An attacker who can control content stored in a Trix editor can craft HTML containing a data-trix-serialized-attributes attribute with malicious event handlers that execute when the content is rendered, potentially allowing execution of arbitrary JavaScript code within the context of the user's session. This could lead to unauthorized actions being performed or sensitive information being disclosed. Red Hat ships Trix editor versions 3.4.3, 3.4.4, 6.3.0, and 6.4.0 in OpenShift AI and Ansible on Clouds services, all of which are version 2.1.17 or later and are therefore not affected by this vulnerability.
Mitigation
Red Hat products are not affected by this vulnerability as they ship Trix editor version 2.1.17 or later, which includes the fix for this issue. No action is required for Red Hat product users.
For customers who may be using Trix editor independently in custom applications or integrations outside of Red Hat products, ensure that the Trix npm package or action_text-trix RubyGem is upgraded to version 2.1.17 or later. After upgrading, review any stored content that may have been created with vulnerable versions of Trix to ensure it does not contain malicious serialized attributes. Consider implementing Content Security Policy (CSP) headers to provide an additional layer of defense against XSS attacks.
Understanding the Weakness (CWE)
Access Control,Confidentiality
Technical Impact: Bypass Protection Mechanism; Read Application Data
The most common attack performed with cross-site scripting involves the disclosure of private information stored in user cookies, such as session information. Typically, a malicious user will craft a client-side script, which -- when parsed by a web browser -- performs some activity on behalf of the victim to an attacker-controlled system (such as sending all site cookies to a given E-mail address). This could be especially dangerous to the site if the victim has administrator privileges to manage that site. This script will be loaded and run by each user visiting the web site. Since the site requesting to run the script has access to the cookies in question, the malicious script does also.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
In some circumstances it may be possible to run arbitrary code on a victim's computer when cross-site scripting is combined with other flaws, for example, "drive-by hacking."
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Read Application Data
The consequence of an XSS attack is the same regardless of whether it is stored or reflected. The difference is in how the payload arrives at the server. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. Some cross-site scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, running "Active X" controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy, and modifying presentation of content.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
