CVE-2026-73427: fallo de gravedad baja en basecamp trix
Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 2.1epss 0.6%
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without Input Events Level 2 support. The StringPiece.fromJSON method trusts href attributes from the JSON payload without sanitization, allowing a draggable element containing a javascript: URI to bypass DOMPurify sanitization and inject executable JavaScript into the DOM. Exploitation requires the victim to drag and drop attacker-controlled content, and server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
basecamp · trixCVEs relacionadas — basecamp trix
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-34341MEDIUMThe Trix Editor Contains an Arbitrary Code Execution VulnerabilityEPSS 0.8%CVE-2025-46812LOWTrix vulnerable to Cross-site Scripting on copy & pasteEPSS 0.7%CVE-2024-43368MEDIUMTrix has a Cross-Site Scripting (XSS) vulnerability on copy & pasteEPSS 0.5%CVE-2024-53847MEDIUMTrix vulnerable to Cross-site Scripting on copy & pasteEPSS 0.5%CVE-2025-21610MEDIUMTrix allows Cross-site Scripting via `javascript:` url in a linkEPSS 0.4%CVE-2026-73428MEDIUMTrix: Stored XSS via HTMLParser attribute injection on pasteEPSS 0.4%