Trix

This hub aggregates every CVE we track for Trix, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 12 most recently published vulnerabilities affecting Trix.

• CVE-2026-73426Trix: Stored XSS vulnerability through serialized attributes4.6Aug 18, 2026
• CVE-2026-73428Trix: Stored XSS via HTMLParser attribute injection on paste4.6Aug 13, 2026
• CVE-2026-73427Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)Aug 12, 2026
• GHSA-53g2-mvcc-q9x3Trix: Stored XSS via HTMLParser attribute injection on pasteJul 24, 2026
• GHSA-53p3-c7vp-4mccTrix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)Mar 29, 2026
• GHSA-qmpg-8xg6-ph5qTrix has a Stored XSS vulnerability through serialized attributesMar 12, 2026
• GHSA-g9jg-w8vm-g96vTrix has a stored XSS vulnerability through its attachment attributeDec 31, 2025
• CVE-2025-46812Trix vulnerable to Cross-site Scripting on copy & pasteMay 8, 2025
• CVE-2025-21610Trix allows Cross-site Scripting via `javascript:` url in a link5.3Jan 3, 2025
• CVE-2024-53847Trix vulnerable to Cross-site Scripting on copy & pasteDec 9, 2024
• CVE-2024-43368Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste6.5Aug 14, 2024
• CVE-2024-34341The Trix Editor Contains an Arbitrary Code Execution Vulnerability5.4May 7, 2024