🎯 New Report #3581911: Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer Bypass
🔺Severity: Low
👽 Reporter: newbiefromcoma
⭐️ Reputation: 160
🛠 State: resolved
💼 Team: Basecamp
💵 Bounty: 337
🕐 Submitted: 2026-03-02
⏰ Disclosed: 2026-07-14 19:26:37
📝 Summary: A vulnerability was discovered in Trix Editor version 2.1.16 that allowed for a Stored Cross-Site Scripting (XSS) attack. The vulnerability arose from an unsafe interaction between Trix's custom DOMPurify configuration and its document serialization logic. The issue was caused by Trix's use of the "data-trix-serialized-attributes" attribute, which was not properly sanitized during the serialization process, allowing an attacker to inject malicious JavaScript code. The vulnerability was deemed a direct bypass of previously reported Trix Editor vulnerabilities.
📂 Report JSON File: 3581911
@hackeronereports