CyberRota Analysis
AI-GeneratedThe ProseMirror view component in versions prior to 1.42.3 is vulnerable to a cross-site scripting (XSS) attack due to improper validation of HTML attributes during paste handling. This flaw allows attackers to execute arbitrary JavaScript in the browser, potentially compromising user data and session integrity. Developers and organizations utilizing ProseMirror for document editing should prioritize upgrading to version 1.42.3 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. When a user pastes the crafted HTML into an editor, the unvalidated context attributes can construct content that executes attacker-controlled JavaScript in the browser window containing the editor. This issue is fixed in version 1.42.3.