Prosemirror View
Monthly
Cross-site scripting in prosemirror-view (all versions prior to 1.42.3) lets unauthenticated attackers execute arbitrary JavaScript in the browser window hosting an editor when a victim pastes attacker-crafted HTML into a ProseMirror-backed field. The root cause is in the paste path: attributes delivered through the clipboard slice context are applied without being run through the schema's attribute validators, so crafted markup can smuggle content that the schema would normally reject. Exploitation is gated by that mandatory paste action (CVSS UI:A / UI:R), so it is not triggerable without victim interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis; the fix ships in 1.42.3 as a small change that runs attribute validators on slice-context attributes.
Cross-site scripting in prosemirror-view (all versions prior to 1.42.3) lets unauthenticated attackers execute arbitrary JavaScript in the browser window hosting an editor when a victim pastes attacker-crafted HTML into a ProseMirror-backed field. The root cause is in the paste path: attributes delivered through the clipboard slice context are applied without being run through the schema's attribute validators, so crafted markup can smuggle content that the schema would normally reject. Exploitation is gated by that mandatory paste action (CVSS UI:A / UI:R), so it is not triggerable without victim interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis; the fix ships in 1.42.3 as a small change that runs attribute validators on slice-context attributes.