Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)

Description

The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when a crafted application/x-trix-document JSON payload is dropped into the editor in environments using the fallback Level0InputController (e.g., embedded WebViews lacking Input Events Level 2 support).

The StringPiece.fromJSON method trusted href attributes from the JSON payload without sanitization.

Recommendation

Update the trix package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.1.18
• Patched version(s): 2.1.18

References

• GHSA-53p3-c7vp-4mcc
• CVE-2026-73427
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - CVE-2026-47760
• Trix has a Stored XSS vulnerability through serialized attributes - CVE-2026-73426
• protobufjs: Denial of service through unbounded Any expansion during JSON conversion - CVE-2026-48712
• Webrecorder packages are vulnerable to XSS through 404 error handling logic - CVE-2025-58765

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 1

Tags:

npm

trix