All vulnerabilities
CVE-2026-104847GHSA-c8x8-7fp4-3x9w

ProseMirror has a XSS vulnerability in prosemirror-view's paste handling

ProseMirror prosemirror-viewnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.42.3Fixed versionGitHub
Published2 Oct 2026Updated 5 Oct 2026CVE List

What fixes it

  • 1.42.3prosemirror-view, npmGitHubnpm install prosemirror-view@1.42.3

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

When a user pastes attacker-provided HTML into a ProseMirror editor component, this can cause attacker-controlled JavaScript code to run in the browser window containing the editor.

Patches

Version 1.42.3 adds validation that prevents this attack.

Workarounds

No known workarounds.

Text from GitHub Advisory Database

Affected versions 3

  • prosemirror-view, npm< 1.42.3GitHub
  • prosemirror-viewaffected: < 1.42.3CVE List
  • prosemirror-view, npmfrom first release, fixed in 1.42.3OSV

References 5