Vulnerability · Published Oct 2, 2026 · Assigned by GitHub_M

CVE-2026-104847ProseMirror: XSS vulnerability in prosemirror-view's paste handling

High 8.5

In plain English

A high-severity cross-site scripting in prosemirror-view from ProseMirror. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)0.3%top 77.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. When a user pastes the crafted HTML into an editor, the unvalidated context attributes can construct content that executes attacker-controlled JavaScript in the browser window containing the editor. This issue is fixed in version 1.42.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	prosemirror-view	1.42.3	GHSA-c8x8-7fp4-3x9w

Affected products (as reported)

Vendor	Product	Versions
ProseMirror	prosemirror-view	< 1.42.3

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/ProseMirror/prosemirror-view/security/advisories/GHSA-c8x8-7fp4-3x9w x_refsource_CONFIRM
https://github.com/ProseMirror/prosemirror-view/commit/20dc0a911a79f8fc6640dbbea5e7d68d3c4784b7 x_refsource_MISC
https://github.com/ProseMirror/prosemirror-view/commit/2e91a612bbc1248e55b4f6061fc93fe459f977c1 x_refsource_MISC