Description
When a user pastes attacker-provided HTML into a ProseMirror editor component, this can cause attacker-controlled JavaScript code to run in the browser window containing the editor.
Recommendation
Update the prosemirror-view package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.42.3
- Patched version(s): 1.42.3
References
Could your website be exposed too?
SmartScanner can check your website for ProseMirror has a XSS vulnerability in prosemirror-view's paste handling and gives you actionable findings to investigate.
Start a free scanRelated Issues
- NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability - CVE-2026-30048
- Trix has a Stored XSS vulnerability through serialized attributes - CVE-2026-73426
- SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware - CVE-2026-44651
- Pannellum has a XSS vulnerability in hot spot attributes - CVE-2026-27210
You might also like:
See something that needs correcting? Let us knowUpdated October 05, 2026