Is CVE-2026-73427 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73427 being exploited in the wild.

How severe is CVE-2026-73427?

Medium severity, with a CVSS score of 4, published 12 August 2026.

Which products and versions are affected?

trix (npm) < 2.1.18, SEMVER:introduced=0,fixed=2.1.18; action_text-trix (RubyGems) < 2.1.18, ECOSYSTEM:introduced=0,fixed=2.1.18.

Is there a fix for CVE-2026-73427?

Yes. trix (npm): upgrade to 2.1.18 or later; action_text-trix (RubyGems): upgrade to 2.1.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73427 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-73427?

Check whether you run trix (npm) or action_text-trix (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73427: Basecamp Trix XSS via JSON deserialization in drag-and-drop

Q: Which products and versions are affected?

trix (npm) < 2.1.18, SEMVER:introduced=0,fixed=2.1.18; action_text-trix (RubyGems) < 2.1.18, ECOSYSTEM:introduced=0,fixed=2.1.18.

Q: Is there a fix for CVE-2026-73427?

Yes. trix (npm): upgrade to 2.1.18 or later; action_text-trix (RubyGems): upgrade to 2.1.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-73427 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-73427?

Check whether you run trix (npm) or action_text-trix (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73427 · Severity: medium · CVSS 4 · Published 2026-08-12

Trix is a popular rich text editor used by web applications to provide formatted text editing capabilities. The editor is vulnerable to cross-site scripting (XSS) attacks when users drag and drop specially crafted content into the editor in certain browser environments. An attacker could inject malicious JavaScript that executes with the privileges of the web page, potentially allowing unauthorized access to sensitive data or user accounts.

Technologies: trix (npm), action_text-trix (RubyGems). Vendors: npm, RubyGems.

Quick answers

Is CVE-2026-73427 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73427 being exploited in the wild.
How severe is CVE-2026-73427?: Medium severity, with a CVSS score of 4, published 12 August 2026.
Which products and versions are affected?: trix (npm) < 2.1.18, SEMVER:introduced=0,fixed=2.1.18; action_text-trix (RubyGems) < 2.1.18, ECOSYSTEM:introduced=0,fixed=2.1.18.
Is there a fix for CVE-2026-73427?: Yes. trix (npm): upgrade to 2.1.18 or later; action_text-trix (RubyGems): upgrade to 2.1.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73427 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-73427?: Check whether you run trix (npm) or action_text-trix (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

trix (npm): upgrade to 2.1.18 or later
```
npm install trix@2.1.18
```
action_text-trix (RubyGems): upgrade to 2.1.18 or later
```
bundle update action_text-trix
```

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in Trix's JSON deserialization logic for drag-and-drop operations. The root cause is the StringPiece.fromJSON method trusting href attributes from application/x-trix-document JSON payloads without proper sanitization. When a user drags and drops attacker-controlled content into a Trix editor running on a fallback input controller (e.g., in WebViews without Input Events Level 2 API support), a crafted javascript: URI in the href attribute can bypass DOMPurify sanitization and execute arbitrary JavaScript in the browser. Exploitation requires: (1) a vulnerable environment using Level0InputController; (2) user interaction (drag-drop action); and (3) social engineering to convince the user to drag malicious content. Applications using server-side HTML sanitization (such as Rails' sanitizer) provide additional protection. The vulnerability was patched in version 2.1.18 via commit 9c0a993, which sanitizes javascript: URIs during JSON deserialization.

Affected products

Basecamp Trix < 2.1.18
Basecamp action_text-trix < 2.1.18

Identifiers

CVE-2026-73427
GHSA-53p3-c7vp-4mcc

Timeline

2026-03-29: disclosed
2026-03-26: patched: Version 2.1.18 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.