Executive brief
Trix is a popular rich text editor used by web applications to provide formatted text editing capabilities. The editor is vulnerable to cross-site scripting (XSS) attacks when users drag and drop specially crafted content into the editor in certain browser environments. An attacker could inject malicious JavaScript that executes with the privileges of the web page, potentially allowing unauthorized access to sensitive data or user accounts.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in Trix's JSON deserialization logic for drag-and-drop operations. The root cause is the StringPiece.fromJSON method trusting href attributes from application/x-trix-document JSON payloads without proper sanitization. When a user drags and drops attacker-controlled content into a Trix editor running on a fallback input controller (e.g., in WebViews without Input Events Level 2 API support), a crafted javascript: URI in the href attribute can bypass DOMPurify sanitization and execute arbitrary JavaScript in the browser. Exploitation requires: (1) a vulnerable environment using Level0InputController; (2) user interaction (drag-drop action); and (3) social engineering to convince the user to drag malicious content. Applications using server-side HTML sanitization (such as Rails' sanitizer) provide additional protection. The vulnerability was patched in version 2.1.18 via commit 9c0a993, which sanitizes javascript: URIs during JSON deserialization.
Affected products
- Basecamp Trix < 2.1.18
- Basecamp action_text-trix < 2.1.18
Timeline
- 2026-03-29: disclosed
- 2026-03-26: patched: Version 2.1.18 released with fix
References
- https://github.com/basecamp/trix/security/advisories/GHSA-53p3-c7vp-4mcc
- https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c
- https://github.com/basecamp/trix
- https://github.com/basecamp/trix/releases/tag/v2.1.18
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/action_text-trix/GHSA-53p3-c7vp-4mcc.yml