MEDIUM4.6npmRubyGems
GHSA-53g2-mvcc-q9x3· CVE-2026-73428Trix: Stored XSS via HTMLParser attribute injection on paste
Modified: 8/12/2026
package
npm/trix
pkg:npm/trix
LOWnpmRubyGems
GHSA-53p3-c7vp-4mcc· CVE-2026-73427Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)
Modified: 9/10/2026
MEDIUMnpm
GHSA-6vx4-v2jw-qwqh· CVE-2024-53847Trix editor subject to XSS vulnerabilities on copy & paste
Modified: 12/9/2024
MEDIUM4.6npmRubyGems
GHSA-g9jg-w8vm-g96vTrix has a stored XSS vulnerability through its attachment attribute
Modified: 9/10/2026
MEDIUM5.3npm
GHSA-j386-3444-qgwg· CVE-2025-21610Trix allows Cross-site Scripting via `javascript:` url in a link
Modified: 1/3/2025
LOWnpm
GHSA-mcrw-746g-9q8h· CVE-2025-46812Trix vulnerable to Cross-site Scripting on copy & paste
Modified: 5/8/2025
MEDIUM5.4npmRubyGems
GHSA-qjqp-xr96-cj99· CVE-2024-34341Trix Editor Arbitrary Code Execution Vulnerability
Modified: 2/4/2026
MEDIUM6.5npm
GHSA-qm2q-9f3q-2vcv· CVE-2024-43368Trix has a cross-site Scripting vulnerability on copy & paste
Modified: 2/4/2026
MEDIUM4.6RubyGemsnpm
GHSA-qmpg-8xg6-ph5q· CVE-2026-73426Trix has a Stored XSS vulnerability through serialized attributes
Modified: 9/10/2026