Trix Editor EUVD-2026-57622

Two specific conditions must simultaneously hold for exploitation to succeed. First, the Trix editor must be operating via the Level0InputController fallback - this occurs only in environments lacking Input Events Level 2 API support, primarily mobile embedded WebViews (e.g., Android WebView, iOS WKWebView in configurations that disable the API) and certain iframes; standard desktop Chrome, Firefox, and Safari are not affected because they use the modern InputController path. Second, the victim must actively drag and drop attacker-controlled content into the editor, requiring social engineering (e.g., luring the user to drag a crafted element from an attacker-controlled page or iframe). Applications deploying server-side HTML sanitization (such as Rails ActionText's default sanitizer) gain an additional mitigating layer that strips javascript: URIs when content is persisted, limiting impact to the unsaved in-memory session. Authentication requirements are not determinable from CVSS PR:N alone; that metric reflects the attacker's privilege level, not whether the editor itself requires a logged-in session.

Real-world risk is low, and the CVSS 4.0 score of 2.1 reflects this accurately. The vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N encodes three hard constraints: AT:P (a specific environmental condition - Level0InputController fallback - must be present), UI:A (the victim must actively perform a drag-and-drop of attacker-controlled content), and limited impact (VI:L only; no confidentiality or availability loss). Applications using standard Rails ActionText receive server-side sanitization as an additional layer that neutralizes the payload on save, further reducing effective exposure. No EPSS score was present in the input data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is absent from CISA KEV, and no public exploit code has been identified. The combination of a non-default environment, mandatory social engineering, and readily available mitigations makes this a low-priority finding for most production deployments, though WebView-heavy mobile applications embedding Trix editors should treat it with higher urgency.

An attacker hosts a web page containing a draggable element whose MIME type is application/x-trix-document and whose JSON body encodes a string piece with href set to javascript:alert(document.cookie). A victim using a mobile application that embeds a Trix editor in a WebView drags this element into the editor; the Level0InputController processes the drop, deserializes the JSON via StringPiece.fromJSON, and inserts an anchor element with the unsanitized javascript: href into the DOM. When the victim clicks the rendered link text, the script executes in the application's WebView context with access to the page's cookies and DOM.