CVE-2026-104847
CVE-2026-104847 · ProseMirror: XSS vulnerability in prosemirror-view's paste handling
This page contains facts from public vulnerability sources. Check the original advisory before updating.
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. When a user pastes the crafted HTML into an editor, the unvalidated context attributes can construct content that executes attacker-controlled JavaScript in the browser window containing the editor. This issue is fixed in version 1.42.3.
CVSS 8.5 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
prosemirror-view
- Versions
- < 1.42.3: Affected
No fix published
prosemirror-view npm
- Affected ranges
- SEMVER: < 1.42.3
Update to 1.42.3
Original sources
- https://github.com/ProseMirror/prosemirror-view/security/advisories/GHSA-c8x8-7fp4-3x9w
- https://github.com/ProseMirror/prosemirror-view/commit/20dc0a911a79f8fc6640dbbea5e7d68d3c4784b7
- https://github.com/ProseMirror/prosemirror-view/commit/2e91a612bbc1248e55b4f6061fc93fe459f977c1
- https://nvd.nist.gov/vuln/detail/CVE-2026-104847