Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values

🗓️ 06 Nov 2025 15:44:35Reported by GitHub Advisory DatabaseType

Prosemirror_to_html is vulnerable to XSS from unescaped attributes; upgrade to 0.2.1 when released and sanitize output.

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2025-64501	11 Nov 202500:13	–	circl
CNNVD	ProsemirrorToHtml Cross-site Scripting Vulnerability	10 Nov 202500:00	–	cnnvd
CVE	CVE-2025-64501	10 Nov 202521:37	–	cve
Cvelist	CVE-2025-64501 ProsemirrorToHtml: Cross-Site Scripting vulnerability through unescaped HTML attribute values	10 Nov 202521:37	–	cvelist
EUVD	EUVD-2025-50824	10 Nov 202521:37	–	euvd
Mend	CVE-2025-64501	10 Nov 202521:37	–	mend
NVD	CVE-2025-64501	10 Nov 202522:15	–	nvd
osv_cve	CVE-2025-64501 ProsemirrorToHtml: Cross-Site Scripting vulnerability through unescaped HTML attribute values	10 Nov 202521:37	–	osv_cve
osv_ghsa	GHSA-52C5-VH7F-26FX Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values	6 Nov 202515:44	–	osv_ghsa
Positive Technologies	PT-2025-46205	10 Nov 202500:00	–	ptsecurity

Vulners

Node

prosemirror_to_htmlRange<0.2.1rubygems

Source	Link
github	www.github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx
github	www.github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-64501
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/prosemirror_to_html/CVE-2025-64501.yml
github	www.github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/prosemirror_to_html/GHSA-vfpf-xmwh-8m65.yml
github	www.github.com/advisories/GHSA-52c5-vh7f-26fx

23 Jan 2026 21:37Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.17.6

EPSS0.00237

SSVC