CVE-2026-73428 describes a stored cross-site scripting vulnerability in Basecamp's Trix editor before version 2.1.18. The vulnerability occurs because HTMLParser processes a mock attachment in a <span> with an empty data-trix-attachment attribute, causing data-trix-attributes to be applied to a plain string piece. The StringPiece.fromJSON method accepts an unvalidated href, allowing a javascript: URI to be injected into the document model. This malicious URI can be serialized into HTML and executed when another user renders and clicks the content. Server-side HTML sanitization can neutralize the payload on save. The issue is resolved in Trix version 2.1.18.

An attacker can inject malicious javascript: URIs into the Trix editor content, leading to stored cross-site scripting. This can result in execution of arbitrary JavaScript in the context of users viewing the content, potentially compromising confidentiality and integrity. The CVSS score is 4.6 (medium severity), reflecting limited impact with user interaction required and low privileges needed.

Upgrade Trix to version 2.1.18 or later, where this vulnerability is fixed. Alternatively, apply server-side HTML sanitization to neutralize malicious payloads on save. Since the vendor advisory does not specify an official fix beyond the version update, patching to 2.1.18 is the recommended remediation.