MEDIUM4.6npmRubyGems
GHSA-53g2-mvcc-q9x3· CVE-2026-73428Trix: Stored XSS via HTMLParser attribute injection on paste
Modified: 8/12/2026
package
RubyGems/action_text-trix
pkg:rubygems/action_text-trix
LOWnpmRubyGems
GHSA-53p3-c7vp-4mcc· CVE-2026-73427Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)
Modified: 9/10/2026
MEDIUM4.6npmRubyGems
GHSA-g9jg-w8vm-g96vTrix has a stored XSS vulnerability through its attachment attribute
Modified: 9/10/2026
MEDIUM4.6RubyGemsnpm
GHSA-qmpg-8xg6-ph5q· CVE-2026-73426Trix has a Stored XSS vulnerability through serialized attributes
Modified: 9/10/2026