CVE-2026-73427

Received Received - Intake

XSS in Trix Rich Text Editor via Draggable JSON Payload

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without Input Events Level 2 support. The StringPiece.fromJSON method trusts href attributes from the JSON payload without sanitization, allowing a draggable element containing a javascript: URI to bypass DOMPurify sanitization and inject executable JavaScript into the DOM. Exploitation requires the victim to drag and drop attacker-controlled content, and server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-73427

Affected Vendors & Products

Vendor	Product	Version / Range
basecamp	trix	2.1.18

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Trix is a rich text editor vulnerable to cross-site scripting (XSS) due to improper handling of crafted JSON payloads. When a malicious application/x-trix-document JSON payload is dropped into the editor using the fallback Level0InputController, it can inject executable JavaScript into the DOM. This occurs because the StringPiece.fromJSON method trusts href attributes without sanitization, allowing a draggable element with a javascript: URI to bypass DOMPurify sanitization.

Detection Guidance

Detection involves checking for Trix editor versions prior to 2.1.18 and monitoring for suspicious drag-and-drop actions involving javascript: URIs. Inspect network traffic for application/x-trix-document JSON payloads with untrusted href attributes. No specific commands are provided in the context.

Impact Analysis

This vulnerability requires user interaction to exploit, specifically dragging and dropping attacker-controlled content. If successful, it could allow an attacker to execute arbitrary JavaScript in the victim's browser session, potentially leading to session hijacking, data theft, or unauthorized actions on behalf of the user.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR (data protection) and HIPAA (healthcare data privacy) requirements. Organizations using vulnerable versions of Trix may face compliance risks if exploitation results in data breaches or unauthorized data exposure.

Mitigation Strategies

Upgrade Trix to version 2.1.18 or later. Implement server-side HTML sanitization to neutralize malicious payloads. Disable drag-and-drop functionality for untrusted content if possible. Monitor for unusual activity involving javascript: URIs.

Hi! I’m here to help you understand CVE-2026-73427. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70