Trix has a stored XSS vulnerability through its attachment attribute

Description

The Trix editor, in versions prior to 2.1.16, is vulnerable to XSS attacks through attachment payloads.

Recommendation

Update the trix package to the latest compatible version. Followings are version details:

Affected version(s): < 2.1.16
Patched version(s): 2.1.16

References

GHSA-g9jg-w8vm-g96v
CWE-79
OWASP 2021-A3

Could your website be exposed too?

SmartScanner can check your website for Trix has a stored XSS vulnerability through its attachment attribute and gives you actionable findings to investigate.

Start a free scan

Related Issues

Trix has a Stored XSS vulnerability through serialized attributes - CVE-2026-73426
devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted - Vulnerability
NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability - CVE-2026-30048
Trix: Stored XSS via HTMLParser attribute injection on paste - CVE-2026-73428

How to Secure your NodeJs Express Javascript Application - part 1

These 7 PHP mistakes leave your website open to the hackers

How do hackers hack websites?

See something that needs correcting? Let us knowUpdated January 08, 2026