12 matches found
GHSA-C8X8-7FP4-3X9W ProseMirror has a XSS vulnerability in prosemirror-view's paste handling
Impact When a user pastes attacker-provided HTML into a ProseMirror editor component, this can cause attacker-controlled JavaScript code to run in the browser window containing the editor. Patches Version 1.42.3 adds validation that prevents this attack. Workarounds No known workarounds...
ProseMirror has a XSS vulnerability in prosemirror-view's paste handling
Impact When a user pastes attacker-provided HTML into a ProseMirror editor component, this can cause attacker-controlled JavaScript code to run in the browser window containing the editor. Patches Version 1.42.3 adds validation that prevents this attack. Workarounds No known workarounds...
NPM: ProseMirror has a XSS vulnerability in prosemirror-view's paste handling
NPM: ProseMirror has a XSS vulnerability in prosemirror-view's paste handling discovered by ? in WordPress Npm prosemirror-view versions 1.42.3...
@9troisquarts/ant-form (>=2.0.1, <=4.0.5), @activepieces/piece-jira-cloud (>=0.1.13, <=0.3.6) +658 more potentially affected by CVE-2026-104847 via prosemirror-view (>=1.3.0, <=1.42.2)
prosemirror-view NPM version =1.3.0, =2.0.1, =0.1.13, =3.0.0-beta.4, =0.4.0, =11.21.3, =0.1.0, =11.19.4, =11.13.0, =0.0.1, =0.0.1, =13.1.0, =1.7.5, =4.0.4 and more Source cves: CVE-2026-104847 Source advisory: OSV:GHSA-C8X8-7FP4-3X9W...
@9troisquarts/ant-form (>=2.0.1, <=4.0.5), @activepieces/piece-jira-cloud (>=0.1.13, <=0.3.6) +658 more potentially affected by CVE-2026-104847 via prosemirror-view (>=1.3.0, <=1.42.2)
prosemirror-view NPM version =1.3.0, =2.0.1, =0.1.13, =3.0.0-beta.4, =0.4.0, =11.21.3, =0.1.0, =11.19.4, =11.13.0, =0.0.1, =0.0.1, =13.1.0, =1.7.5, =4.0.4 and more Source cves: CVE-2026-104847 Source advisory: GHSA-C8X8-7FP4-3X9W...
CVE-2026-104847
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. Whe...
CVE-2026-104847 ProseMirror: XSS vulnerability in prosemirror-view's paste handling
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. Whe...
CVE-2026-104847 ProseMirror: XSS vulnerability in prosemirror-view's paste handling
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. Whe...
CVE-2026-104847
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. Whe...
@9troisquarts/ant-form (>=2.0.1, <=4.0.5), @activepieces/piece-jira-cloud (>=0.1.13, <=0.3.6) +672 more potentially affected by CVE-2026-104847 via prosemirror-view (>=0.11.2, <=1.42.2)
prosemirror-view NPM version =0.11.2, =2.0.1, =0.1.13, =3.0.0-beta.4, =0.4.0, =11.21.3, =0.1.0, =11.19.4, =11.13.0, =0.0.1, =0.0.1, =13.1.0, =1.7.5, =4.0.4 and more Source cves: CVE-2026-104847 Source advisory: MEND:CVE-2026-104847...
CVE-2026-104847
The prosemirror-view component in ProseMirror (prior to version 1.42.3 ) is vulnerable to a Cross-Site Scripting (XSS) flaw. The issue arises because the paste handling mechanism accepts attacker-provided HTML where clipboard slice context attributes bypass schema attribute validation . An attack...
CVE-2026-104847 ProseMirror: XSS vulnerability in prosemirror-view's paste handling
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. Whe...