CVE-2026-73427 in Trix
Summary
by MITRE • 08/12/2026
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without Input Events Level 2 support. The StringPiece.fromJSON method trusts href attributes from the JSON payload without sanitization, allowing a draggable element containing a javascript: URI to bypass DOMPurify sanitization and inject executable JavaScript into the DOM. Exploitation requires the victim to drag and drop attacker-controlled content, and server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
Trix represents a rich text editing framework designed for web applications that handle formatted text input through a what-you-see-is-what-you-get interface. The vulnerability discovered affects versions prior to 2.1.18 and specifically targets the document handling mechanism within the editor's fallback controller implementation. This flaw manifests when the Level0InputController processes application/x-trix-document JSON payloads, particularly in embedded WebView environments that lack support for Input Events Level 2 specifications. The security concern arises from the editor's insufficient validation of href attributes within JSON payload data structures.
The core technical vulnerability stems from the StringPiece.fromJSON method which directly trusts and incorporates href values from incoming JSON without proper sanitization or validation procedures. This trust-based approach allows malicious actors to craft specially formatted JSON documents containing javascript: URIs within draggable elements. These crafted elements can bypass DOMPurify's sanitization mechanisms because the framework does not adequately filter or escape the href attributes before rendering them in the document object model. The vulnerability specifically exploits the gap between client-side input handling and security validation, creating an execution path for malicious JavaScript code injection.
The operational impact of this cross-site scripting vulnerability requires specific user interaction through drag-and-drop operations to execute successfully. This interaction pattern limits the exploit's automation potential but maintains significant risk since it only requires a victim to perform a simple drag-and-drop action. The attack vector is particularly concerning in environments where users regularly interact with rich text editors, as the malicious payload can be embedded within legitimate-looking content or documents. Server-side HTML sanitization provides a potential mitigation layer during document save operations, but this protection relies on proper implementation and may not cover all execution paths within the editor's client-side rendering pipeline.
This vulnerability aligns with CWE-79 Cross-site Scripting and maps to ATT&CK technique T1203 Exploitation for Client Execution through web-based attacks. The flaw demonstrates a classic insecure data handling pattern where user-supplied JSON data is processed without proper input validation, creating an attack surface that can be exploited by adversaries seeking to execute arbitrary JavaScript code within victim browsers. The fix implemented in version 2.1.18 addresses the root cause by introducing proper sanitization of href attributes and ensuring that javascript: URIs are properly escaped or filtered before DOM insertion occurs.
Organizations using Trix editors should implement immediate mitigation strategies including updating to version 2.1.18 or higher, implementing additional client-side input validation for JSON payloads, and educating users about the risks associated with drag-and-drop operations involving untrusted content. The vulnerability highlights the importance of proper input sanitization in rich text editing frameworks and demonstrates how seemingly isolated components within web applications can create significant security exposure when insufficiently validated. Security teams should monitor for similar patterns in other rich text editors and ensure that all user-supplied data undergoes appropriate sanitization before being processed or rendered within web applications.