CVE-2026-73427: Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without Input Events Level 2 support. The StringPiece.fromJSON method trusts href attributes from the JSON payload without sanitization, allowing a draggable element containing a javascript: URI to bypass DOMPurify sanitization and inject executable JavaScript into the DOM. Exploitation requires the victim to drag and drop attacker-controlled content, and server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Trixto a version that resolves this vulnerability.Fixed in 2.1.18 - Configuration
For embedded WebViews/implementations, enable Input Events Level 2 so that Trix does not fall back to Level0InputController, which is specifically mentioned as vulnerable for this issue prior to 2.1.18.
Trix Input Events Level 2 support (Level0InputController fallback usage) = Ensure Level 2 input events are supported to avoid the fallback Level0InputController - Compensating control
Mitigate exploitation by preventing users from dragging and dropping attacker-controlled content into the Trix editor (XSS requires victim drag-and-drop of crafted content).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73427?
The severity of CVE-2026-73427 is rated as risk 33.
How do I fix CVE-2026-73427?
To fix CVE-2026-73427, upgrade Trix to version 2.1.18 or later.
What type of vulnerability is CVE-2026-73427?
CVE-2026-73427 is a cross-site scripting (XSS) vulnerability.
Which software is affected by CVE-2026-73427?
CVE-2026-73427 affects Trix versions prior to 2.1.18.
What causes the vulnerability in CVE-2026-73427?
The vulnerability in CVE-2026-73427 is caused by a JSON deserialization bypass in the drag-and-drop functionality of the Level0InputController.