This vulnerability in the Trix rich‑text editor allows an attacker to inject script through the data-trix-serialized-attributes attribute. The injected payload bypasses the DOMPurify sanitizer, leading to stored cross‑site scripting. When a user loads the offending content, arbitrary JavaScript executes in the browser session, enabling unauthorized actions or data theft.

The flaw affects any installation of Basecamp Trix prior to version 2.1.17. Clients that embed the editor in webpages or content management systems and display data from untrusted sources are at risk if they have not upgraded the editor.

With a CVSS score of 4.6, the vulnerability presents moderate risk, and it is not listed in CISA KEV. The EPSS score is not available; exploitation requires an attacker to supply crafted HTML that the editor parses for a user. Because the flaw is client‑side, the attack surface is limited to contexts where the editor renders user content, such as publicly exposed pages or malicious files.