GitHub Advisoryadvisory · npm

GHSA-c8x8-7fp4-3x9w ProseMirror has a XSS vulnerability in prosemirror-view's paste handling

HIGH Published 2026-10-05 Modified 2026-10-05 Official page ↗
Aliases
CVE-2026-104847
Ecosystem
npm
Packages
prosemirror-view
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2026-10-05

Affected packages

• npm prosemirror-view: < 1.42.3 → fixed in 1.42.3

Description

Impact When a user pastes attacker-provided HTML into a ProseMirror editor component, this can cause attacker-controlled JavaScript code to run in the browser window containing the editor. Patches Version 1.42.3 adds validation that prevents this attack. Workarounds No known workarounds.

Related

Alias · CVE (1)

  • CVE-2026-104847 ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References