CVE-2026-73427

Name of the Vulnerable Software and Affected Versions Trix versions prior to 2.1.18

Description Cross-site scripting occurs when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, which is common in embedded WebViews lacking Input Events Level 2 support. The StringPiece.fromJSON() method fails to sanitize href attributes from the JSON payload, enabling a draggable element with a javascript: URI to bypass DOMPurify sanitization and inject executable JavaScript into the DOM. This requires the victim to drag and drop attacker-controlled content, although server-side HTML sanitization may neutralize the payload upon saving.

Recommendations Update to version 2.1.18.