Medium [CVE-2026-73427] Cross-site scripting via crafted JSON drag-and-drop
This medium-severity Red Hat Linux advisory covers CVE-2026-73427.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without Input Events Level 2 support.
The StringPiece.fromJSON method trusts href attributes from the JSON payload without sanitization, allowing a draggable element containing a javascript: URI to bypass DOMPurify sanitization and inject executable JavaScript into the DOM.
Exploitation requires the victim to drag and drop attacker-controlled content, and server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.
A remote attacker could exploit this vulnerability by convincing a victim to drag and drop a specially crafted JSON payload into an editor using the Level0InputController. This could bypass sanitization and allow the injection of executable JavaScript into the web page, leading to cross-site scripting (XSS).
The version of action_text-trix shipped in Red Hat products is not affected by this vulnerability as it already includes the fix. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
Weakness: CWE-79.
- < 2.1.18
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- Upgrading to Trix 2.1.18+ resolves this issue. Applications using server-side HTML sanitization (such as Rails' built-in sanitizer) provide additional protection.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.