Cross-Site Scripting Vulnerability in Trix Rich Text Editor by Basecamp

CVE-2026-73427

What is CVE-2026-73427?

The Trix rich text editor, used for WYSIWYG editing, has a vulnerability that allows cross-site scripting when a malicious JSON payload is injected into the editor using unsupported input events. This occurs through the Level0InputController, particularly in environments like embedded WebViews. The issue arises from the StringPiece.fromJSON method, which does not properly sanitize href attributes from the JSON payload, enabling attackers to drop draggable elements that can execute JavaScript by bypassing DOMPurify's protections. It is crucial for developers and administrators to upgrade to Trix version 2.1.18 or later where this vulnerability has been addressed.

References