npm/trix CVE-2026-73427: low 2.1, EPSS 0.57%
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)
Action: Upgrade trix to 2.1.18 or later.
npm i trix@2.1.18Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.18 | - |
Fixed versions
| 2.1.18 |
Sources
- osv: GHSA-53p3-c7vp-4mcc
- nvd: CVE-2026-73427
- https://github.com/basecamp/trix/security/advisories/GHSA-53p3-c7vp-4mcc
- https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c
- https://github.com/basecamp/trix
- https://github.com/basecamp/trix/releases/tag/v2.1.18
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/action_text-trix/GHSA-53p3-c7vp-4mcc.yml
CVE-2026-73427 · published · modified · JSON