Most recent entries from all

fkie_cve-2026-104847

2026-10-26T14:20:25.798697+00:00

ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. When a user pastes the crafted HTML into an editor, the unvalidated context attributes can construct content that executes attacker-controlled JavaScript in the browser window containing the editor. This issue is fixed in version 1.42.3.

GHSA-c8x8-7fp4-3x9w — ProseMirror has a XSS vulnerability in prosemirror-view's paste handling

2026-10-26T14:20:25.798770+00:00

Affected: npm: prosemirror-view

### Impact

When a user pastes attacker-provided HTML into a ProseMirror editor component, this can cause attacker-controlled JavaScript code to run in the browser window containing the editor.

### Patches

Version 1.42.3 adds validation that prevents this attack.

### Workarounds

No known workarounds.