A JSON payload dropped into a Trix editor injects a script tag via a javascript: URI that bypasses DOMPurify. The flaw lies in the StringPiece.fromJSON method, which trusts href attributes from the JSON payload without sanitization. The result is a classic cross‑site scripting vulnerability where an attacker can execute arbitrary JavaScript in the victim's browser. This can compromise user sessions, steal credentials, or manipulate the page permanently.

The vulnerability impacts installations of Basecamp Trix version 2.1.17 and earlier that use the Level0InputController fallback. Any environment that supports drag‑and‑drop into the editor—such as custom web pages or embedded WebViews lacking Input Events Level 2 support—can be affected. The defect has been remediated in Trix 2.1.18.

The CVSS score of 2.1 classifies the flaw as low severity, and the EPSS score is not available, suggesting no known large‑scale exploitation. The issue is not listed in the CISA KEV catalogue. Exploitation requires a user to manually drag and drop attacker‑controlled content into the editor, which is a low‑probability attack vector. Nonetheless, any web application that incorporates Trix and allows drag‑and‑drop could be compromised if this flaw is present.