01 Record

CVE-2026-73428

Trix: Stored XSS via HTMLParser attribute injection on paste

MediumPUBLISHEDCNA: GitHub_M

Base score4.6 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

02 Description

Trix: Stored XSS via HTMLParser attribute injection on paste

Published: 2026-08-13 22:04Z20 HR AGO
Last updated: 2026-08-14 18:06Z38 MIN AGO
Reserved: 2026-08-12
Assigning CNA: GitHub_M
Record state: PUBLISHED
Severity: Medium (CVSS 4.6)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses: CWE-79
SSVC decision: ExploitationnoneAutomatablenoTechnical Impactpartial
Data version: 5.2
Document digest: 9c85fc7667cfcd49a8d4809c879e51cac813555c588f55a196ea64cffa82b553

VendorProductVersionsPlatforms

basecamptrix< 2.1.18—