high8.5
CVE-2026-104847
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents.
Impact
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. When a user pastes the crafted HTML into an editor, the unvalidated context attributes can construct content that executes attacker-controlled JavaScript in the browser window containing the editor. This issue is fixed in version 1.42.3.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | prosemirror-view | < 1.42.3 | 1.42.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-c8x8-7fp4-3x9w
- https://github.com/ProseMirror/prosemirror-view/security/advisories/GHSA-c8x8-7fp4-3x9w
- https://nvd.nist.gov/vuln/detail/CVE-2026-104847
- https://github.com/ProseMirror/prosemirror-view/commit/20dc0a911a79f8fc6640dbbea5e7d68d3c4784b7
- https://github.com/ProseMirror/prosemirror-view/commit/2e91a612bbc1248e55b4f6061fc93fe459f977c1