Description
The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when a crafted application/x-trix-document JSON payload is dropped into the editor in environments using the fallback Level0InputController (e.g., embedded WebViews lacking Input Events Level 2 support).
The StringPiece.fromJSON method trusted href attributes from the JSON payload without sanitization.
Recommendation
Update the trix package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.1.18
- Patched version(s): 2.1.18
References
Could your website be exposed too?
SmartScanner can check your website for Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - CVE-2026-47760
- Trix has a Stored XSS vulnerability through serialized attributes - CVE-2026-73426
- protobufjs: Denial of service through unbounded Any expansion during JSON conversion - CVE-2026-48712
- Webrecorder packages are vulnerable to XSS through 404 error handling logic - CVE-2025-58765
You might also like:
See something that needs correcting? Let us knowUpdated August 12, 2026