CVE-2026-73427: 
JavaScript Analyse et atténuation des vulnérabilités

CVE-2026-73427 is a cross-site scripting (XSS) vulnerability in the Trix rich text editor (by Basecamp) affecting all versions prior to 2.1.18. The flaw allows an attacker to inject executable JavaScript into the DOM via a crafted application/x-trix-document JSON payload dropped into an editor running the fallback Level0InputController — typically found in embedded WebViews lacking Input Events Level 2 support. It was disclosed on March 26, 2026, and assigned a CVSS v4.0 base score of 2.1 (Low) (GitHub Advisory, Feedly). The vulnerability affects both the trix npm package and the action_text-trix RubyGems package (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The StringPiece.fromJSON method in src/trix/models/string_piece.js directly trusted href attributes from deserialized application/x-trix-document JSON payloads without validation, allowing javascript: URIs to propagate to the DOM (GitHub PR #1293). When a victim drags and drops attacker-controlled content into a vulnerable Trix editor instance using the Level0InputController fallback, the malicious href bypasses DOMPurify sanitization applied at the rendering layer and executes arbitrary JavaScript (GitHub Advisory). Exploitation requires two preconditions: the editor must be running in a Level0InputController environment (e.g., an embedded WebView without Input Events Level 2 support), and the victim must be socially engineered into dragging and dropping attacker-controlled content. The fix adds a DOMPurify.isValidAttribute("a", "href", ...) check at deserialization time in StringPiece.fromJSON to strip invalid href values before they reach the DOM (GitHub Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session within the affected web application, potentially enabling session hijacking, credential theft, or unauthorized actions on behalf of the user. The integrity impact is limited (CVSS v4.0 VI:L), with no direct confidentiality or availability impact scored, reflecting the constrained exploitation conditions (Feedly). Applications using server-side HTML sanitization (such as Rails' built-in sanitizer) receive additional protection, as the malicious payload is neutralized upon saving, limiting the risk of stored XSS propagation (GitHub Advisory).

No public exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is 0.0, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly). Exploitation is significantly constrained by the requirement for a Level0InputController environment and active user interaction (drag-and-drop of attacker-controlled content), making opportunistic mass exploitation unlikely. The vulnerability was responsibly disclosed by HackerOne researcher newbiefromcoma (GitHub Advisory).

1. Identify a vulnerable target: Locate a web application embedding the Trix editor (versions < 2.1.18) in an environment using the Level0InputController fallback, such as an embedded WebView without Input Events Level 2 support.
2. Craft a malicious payload: Construct a JSON payload conforming to the application/x-trix-document format, embedding a javascript: URI in the href attribute of a string piece, e.g.:

[{"text": [{"type": "string", "string": "Click me", "attributes": {"href": "javascript:alert(document.cookie)"}}], "attributes": [], "htmlAttributes": {}}]

3. Create a draggable element: Host or inject a draggable HTML element (e.g., a <div draggable="true">) whose dataTransfer data is set to the crafted application/x-trix-document JSON payload.
4. Social engineer the victim: Trick the victim into dragging the attacker-controlled element and dropping it into the vulnerable Trix editor field (e.g., via a phishing page or malicious content on a shared platform).
5. Trigger XSS: Upon drop, Level0InputController processes the application/x-trix-document MIME type, StringPiece.fromJSON deserializes the payload without sanitizing the href, and the javascript: URI is inserted into the DOM, executing the attacker's JavaScript in the victim's browser context (GitHub Advisory, GitHub PR #1293).

• Network: Unusual drag-and-drop interactions originating from external or untrusted sources into Trix editor-enabled pages; outbound requests to unexpected domains immediately following editor interactions.
• Logs: Browser console errors or JavaScript execution events triggered during drag-and-drop operations in Trix editor fields; server-side logs showing saved Trix document content containing javascript: URI strings (if server-side sanitization is absent).
• File System / Application Data: Trix document JSON payloads stored in the database containing href attributes with javascript: URIs or obfuscated variants (e.g., JavaScript:, \u006aavascript:, or whitespace-padded variants like javascript:) (GitHub PR #1293).

The primary remediation is to upgrade the Trix editor to version 2.1.18 or later, which adds a DOMPurify.isValidAttribute check in StringPiece.fromJSON to strip invalid href values at deserialization time (GitHub Release v2.1.18). Both the trix npm package and the action_text-trix RubyGems package are patched in version 2.1.18 (GitHub Advisory). As a defense-in-depth measure, applications should implement server-side HTML sanitization (e.g., Rails' built-in sanitizer) to neutralize any malicious payloads upon save, even if client-side sanitization is bypassed.

The vulnerability was responsibly reported by HackerOne researcher newbiefromcoma and patched by Basecamp maintainer flavorjones on March 26, 2026, with the fix merged and released the same day (GitHub Advisory, GitHub Release v2.1.18). No significant broader media coverage or notable community controversy has been observed, consistent with the low CVSS score and constrained exploitation conditions.