This vulnerability is a Stored Cross‑Site Scripting flaw (CWE‑79). A malicious user can craft an HTML fragment that includes a javascript: URI, paste it into the Trix rich‑text editor, and have the HTMLParser incorrectly apply data‑trix‑attributes to a plain string piece. The unvalidated href is then stored in the editor’s document model. When another user later renders or clicks the content, the embedded script executes in the victim’s browser context, enabling the attacker to run arbitrary JavaScript, steal credentials, or perform further actions within the application.

Basecamp Trix, for versions earlier than 2.1.18, is affected. Any application embedding Trix and accepting user‑pasted HTML without adequate sanitization inherits this vulnerability, including web‑based collaborative editors or content management systems that rely on the Trix component.

The CVSS score of 4.6 indicates moderate risk, and there is no EPSS score or KEV listing for this issue. Exploitation requires an attacker to place a crafted payload into the editor, have the content stored, and for another user to view or interact with it. There is no network‑based attack or privilege escalation; the vulnerability is confined to cross‑site scripting within the user base. The likely attack vector is user‑initiated copy‑paste of malicious HTML, a low‑barrier method that can be executed in any session that has permission to write content to the editor.