Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without Input Events Level 2 support. The StringPiece.fromJSON method trusts href attributes from the JSON payload without sanitization, allowing a draggable element containing a javascript: URI to bypass DOMPurify sanitization and inject executable JavaScript into the DOM. Exploitation requires the victim to drag and drop attacker-controlled content, and server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| basecamp | trix | before 2.1.18 | 2.1.18 | Patch available | CNA |
| — | trix (npm) | before 2.1.18 | 2.1.18 | Patch available | GHSA-53p3-c7vp-4mcc |
| — | action_text-trix (RubyGems) | before 2.1.18 | 2.1.18 | Patch available | GHSA-53p3-c7vp-4mcc |
- trix Vendorbasecamp Affected before 2.1.18 Fixed in 2.1.18 Patch available CNA
- trix (npm) Vendor— Affected before 2.1.18 Fixed in 2.1.18 Patch available GHSA-53p3-c7vp-4mcc
- action_text-trix (RubyGems) Vendor— Affected before 2.1.18 Fixed in 2.1.18 Patch available GHSA-53p3-c7vp-4mcc
Remediation
- Fix · CNA trix (basecamp) Fixed in 2.1.18
- Fix · GHSA-53p3-c7vp-4mcc trix (npm) Fixed in 2.1.18 Advisory →
- Fix · GHSA-53p3-c7vp-4mcc action_text-trix (RubyGems) Fixed in 2.1.18 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73427
- 2026-10-03 Alias added: GHSA-53p3-c7vp-4mcc
References
Other 6
- https://github.com/basecamp/trix/security/advisories/GHSA-53p3-c7vp-4mcc
- https://github.com/basecamp/trix/pull/1293
- https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c
- https://github.com/basecamp/trix/releases/tag/v2.1.18
- https://github.com/basecamp/trix
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/action_text-trix/GHSA-53p3-c7vp-4mcc.yml
More basecamp vulnerabilities
- TI-2023-18436 Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1… CVSS 3.1HIGH 7.5
- TI-2024-29019 Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste CVSS 3.1MEDIUM 6.5
- TI-2024-36043 Trix vulnerable to Cross-site Scripting on copy & paste CVSS 4.0MEDIUM 5.1
- TI-2018-16075 easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in… CVSS 3.1MEDIUM 6.1
- TI-2024-22682 The Trix Editor Contains an Arbitrary Code Execution Vulnerability CVSS 3.1MEDIUM 5.4
- TI-2025-15570 Trix allows Cross-site Scripting via `javascript:` url in a link CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-73427 · CVE Program
- CVE-2026-73427 · NVD
- FIRST EPSS
- GHSA-53p3-c7vp-4mcc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-73427 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences