https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 26 Oct 2026 19:36:55 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-104847 <p>ProseMirror&#39;s view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. When a user pastes the crafted HTML into an editor, the unvalidated context attributes can construct content that executes attacker-controlled JavaScript in the browser window containing the editor. This issue is fixed in version 1.42.3.</p> <p>ProseMirror&#39;s view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. When a user pastes the crafted HTML into an editor, the unvalidated context attributes can construct content that executes attacker-controlled JavaScript in the browser window containing the editor. This issue is fixed in version 1.42.3.</p> https://db.gcve.eu/vuln/fkie_cve-2026-104847 https://db.gcve.eu/vuln/ghsa-c8x8-7fp4-3x9w <p><strong>Affected:</strong> npm: prosemirror-view</p> <p>### Impact</p> <p>When a user pastes attacker-provided HTML into a ProseMirror editor component, this can cause attacker-controlled JavaScript code to run in the browser window containing the editor.</p> <p>### Patches</p> <p>Version 1.42.3 adds validation that prevents this attack.</p> <p>### Workarounds</p> <p>No known workarounds.</p> <p><strong>Affected:</strong> npm: prosemirror-view</p> <p>### Impact</p> <p>When a user pastes attacker-provided HTML into a ProseMirror editor component, this can cause attacker-controlled JavaScript code to run in the browser window containing the editor.</p> <p>### Patches</p> <p>Version 1.42.3 adds validation that prevents this attack.</p> <p>### Workarounds</p> <p>No known workarounds.</p> https://db.gcve.eu/vuln/ghsa-c8x8-7fp4-3x9w