CVE-2026-104847
CVE-2026-104847 · ProseMirror: XSS vulnerability in prosemirror-view's paste handling
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. When a user pastes the crafted HTML into an editor, the unvalidated context attributes can construct content that executes attacker-controlled JavaScript in the browser window containing the editor. This issue is fixed in version 1.42.3.
CVSS 8.5 · Alta · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
prosemirror-view
- Versiones
- < 1.42.3: Afectada
Sin corrección publicada
prosemirror-view npm
- Intervalos de versiones afectados
- SEMVER: < 1.42.3
Actualiza a 1.42.3
Fuentes originales
- https://github.com/ProseMirror/prosemirror-view/security/advisories/GHSA-c8x8-7fp4-3x9w
- https://github.com/ProseMirror/prosemirror-view/commit/20dc0a911a79f8fc6640dbbea5e7d68d3c4784b7
- https://github.com/ProseMirror/prosemirror-view/commit/2e91a612bbc1248e55b4f6061fc93fe459f977c1
- https://nvd.nist.gov/vuln/detail/CVE-2026-104847