CVE-2026-73427: Trix Rich Text Editor XSS Vulnerability

CVE-2026-73427 Overview

CVE-2026-73427 is a cross-site scripting (XSS) vulnerability [CWE-79] in Trix, a what-you-see-is-what-you-get rich text editor maintained by Basecamp. The flaw affects versions prior to 2.1.18. It is triggered when a crafted application/x-trix-document JSON payload is dropped into an editor that falls back to the Level0InputController, such as an embedded WebView without Input Events Level 2 support. The StringPiece.fromJSON method trusts href attributes from the JSON payload without sanitization, allowing a draggable element containing a javascript: URI to bypass DOMPurify and execute JavaScript in the DOM.

Critical Impact
Successful exploitation executes attacker-controlled JavaScript in the victim's browser context, but requires user interaction via drag-and-drop and can be neutralized by server-side HTML sanitization on save.

Affected Products

Basecamp Trix rich text editor versions prior to 2.1.18
Applications embedding Trix in WebViews lacking Input Events Level 2 support
Downstream integrations such as Rails Action Text bundling the affected trix.js

Discovery Timeline

2026-08-12 - CVE-2026-73427 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73427

Vulnerability Analysis

Trix serializes editor content as JSON documents with the media type application/x-trix-document. When a user drags such a payload into an editor instance, the client deserializes it into internal model objects. The StringPiece.fromJSON method constructs a new piece directly from pieceJSON.attributes without validating the href field. An attacker can craft a JSON document whose href attribute contains a javascript: URI. When the piece is rendered as an anchor element and the victim activates it, the URI executes in the page origin.

The editor relies on DOMPurify to sanitize HTML input paths, but the JSON deserialization path bypasses that filter entirely. The Level0InputController fallback path, used in older WebViews, exposes the drag-and-drop entry point that makes exploitation reachable in embedded contexts.

Root Cause

The root cause is missing input validation on attributes reconstructed from an untrusted JSON payload. StringPiece.fromJSON copied pieceJSON.attributes verbatim into a new piece, so scheme validation on href never occurred. DOMPurify exposes isValidAttribute for exactly this check, but it was not invoked on the deserialization path.

Attack Vector

Exploitation is network-adjacent and requires user interaction. An attacker hosts a page that offers a crafted application/x-trix-document payload as a draggable element. The victim drags it into a Trix editor rendered inside a vulnerable WebView. Once dropped, the malicious href is preserved in the DOM. Activation of the resulting anchor executes the attacker's JavaScript in the origin of the hosting application.

javascript

// Patch: src/trix/models/string_piece.js
// Source: https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c
+import DOMPurify from "dompurify"
+
 import Piece from "trix/models/piece"

 import { normalizeNewlines } from "trix/core/helpers"

 export default class StringPiece extends Piece {
   static fromJSON(pieceJSON) {
-    return new this(pieceJSON.string, pieceJSON.attributes)
+    const attributes = { ...pieceJSON.attributes }
+    if (attributes.href && !DOMPurify.isValidAttribute("a", "href", attributes.href)) {
+      delete attributes.href
+    }
+    return new this(pieceJSON.string, attributes)
   }

   constructor(string) {

The patch imports DOMPurify and calls isValidAttribute("a", "href", …) before accepting the attribute. Invalid schemes such as javascript: are stripped before the piece is instantiated. The same change was mirrored in action_text-trix/app/assets/javascripts/trix.js for Rails Action Text consumers. See the GitHub Security Advisory GHSA-53p3-c7vp-4mcc and Pull Request #1293 for the full fix.

Detection Methods for CVE-2026-73427

Indicators of Compromise

Stored Trix content containing anchor tags whose href attribute begins with javascript:, data:, or other non-navigational schemes
Drag-and-drop events into editor surfaces carrying the application/x-trix-document MIME type from external origins
Client-side console errors or CSP violation reports referencing inline script execution originating from anchor activation

Detection Strategies

Inspect persisted Trix JSON documents and rendered HTML for href values that do not match an allow-list of http, https, mailto, or tel schemes
Deploy a strict Content Security Policy that blocks inline script execution and log CSP violation reports centrally for review
Instrument the client to record dragover and drop events that include the application/x-trix-document type and correlate with subsequent navigation or script events

Monitoring Recommendations

Monitor web application logs for POST requests writing Trix content that contains javascript: substrings inside href fields
Track the deployed version of trix.js across applications and alert when versions below 2.1.18 are served
Review WebView-hosted applications on mobile and desktop clients that may still fall back to the Level0InputController code path

How to Mitigate CVE-2026-73427

Immediate Actions Required

Upgrade Trix to version 2.1.18 or later in all applications and rebuild bundles that include trix.js
For Rails applications, update Action Text so it pulls the patched action_text-trix/app/assets/javascripts/trix.js
Apply server-side HTML sanitization on save to strip anchors with non-navigational schemes as a defense-in-depth control

Patch Information

The fix ships in Trix 2.1.18, published as GitHub Release v2.1.18. The change adds a DOMPurify isValidAttribute check to StringPiece.fromJSON, dropping href attributes that reference disallowed schemes. Review the upstream commit and Pull Request #1293 for implementation details.

Workarounds

Enforce server-side sanitization of stored Trix HTML using a library that strips javascript: URIs before persisting or rendering content
Deploy a Content Security Policy that disallows inline scripts and restricts navigation schemes to prevent javascript: execution
Disable drag-and-drop into Trix editors in embedded WebViews where Input Events Level 2 is unavailable until the patched version is deployed

bash

# Update Trix via npm to the patched release
npm install trix@^2.1.18

# Verify installed version
npm ls trix