Stored XSS via serialized attribute expansion

Cross-site scripting in 37signals Trix before 2.1.17 allows remote authenticated users to execute JavaScript via crafted HTML. Trix's DOMPurify hook preserved data-trix-serialized-attributes, and later serialization treated that value as trusted attribute instructions and recreated attacker-chosen DOM attributes with setAttribute(). Low-privileged access to supply stored rich text that another user later renders is required; the demonstrated consequence is script execution in that user's browser session, enabling unauthorized actions or disclosure of session-accessible data.