CVE-2026-73427 is a cross-site scripting vulnerability in Basecamp's Trix editor versions before 2.1.18. The vulnerability occurs because the StringPiece.fromJSON method does not sanitize href attributes in application/x-trix-document JSON payloads, allowing a draggable element with a javascript: URI to bypass DOMPurify sanitization and execute JavaScript in the DOM. Exploitation requires the victim to drag and drop attacker-controlled content into the editor using the fallback Level0InputController, such as in an embedded WebView lacking Input Events Level 2 support. Server-side HTML sanitization can mitigate the payload upon saving. The vulnerability is resolved in Trix version 2.1.18.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when the victim drags and drops malicious content into the editor. This could lead to typical XSS impacts such as session hijacking or UI manipulation. However, the attack requires user interaction and specific conditions (fallback input controller usage). Server-side sanitization can neutralize the payload on save, reducing risk.

Upgrade Trix to version 2.1.18 or later, where this vulnerability is fixed. Additionally, ensure server-side HTML sanitization is applied to neutralize malicious payloads on save. No other immediate actions are required as exploitation requires user interaction and specific input controller conditions.