EUVD-2026-57622Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the required Level0InputController environment; UI:R for mandatory drag-and-drop; no confidentiality or availability impact; scope unchanged as XSS executes within the same page context.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without Input Events Level 2 support. The StringPiece.fromJSON method trusts href attributes from the JSON payload without sanitization, allowing a draggable element containing a javascript: URI to bypass DOMPurify sanitization and inject executable JavaScript into the DOM. Exploitation requires the victim to drag and drop attacker-controlled content, and server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.
AnalysisAI
Cross-site scripting in Trix editor prior to 2.1.18 allows DOM injection via unsanitized javascript: URIs deserialized from attacker-controlled JSON payloads during drag-and-drop operations. The vulnerable path exists exclusively in environments using the Level0InputController fallback - such as embedded WebViews lacking Input Events Level 2 support - where StringPiece.fromJSON applied href attributes from application/x-trix-document JSON directly to anchor elements, bypassing the DOMPurify checks that protected the HTML serialization path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must simultaneously hold for exploitation to succeed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is low, and the CVSS 4.0 score of 2.1 reflects this accurately. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a web page containing a draggable element whose MIME type is `application/x-trix-document` and whose JSON body encodes a string piece with `href` set to `javascript:alert(document.cookie)`. A victim using a mobile application that embeds a Trix editor in a WebView drags this element into the editor; the Level0InputController processes the drop, deserializes the JSON via `StringPiece.fromJSON`, and inserts an anchor element with the unsanitized `javascript:` href into the DOM. … |
| Remediation | Upgrade to Trix version 2.1.18 or later, available for npm via `npm install trix@2.1.18` and for RubyGems via updating the `action_text-trix` gem to `>= 2.1.18`; the tagged release is at https://github.com/basecamp/trix/releases/tag/v2.1.18. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today