CVE-2026-104847
Received Received - Intake

ProseMirror View Component DOM XSS via Unvalidated Clipboard Attributes

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: GitHub, Inc.

Description
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. When a user pastes the crafted HTML into an editor, the unvalidated context attributes can construct content that executes attacker-controlled JavaScript in the browser window containing the editor. This issue is fixed in version 1.42.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-104847
EUVD
EUVD-2026-91749

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
prosemirror prosemirror-view 1.42.3
prosemirror prosemirror-view to 1.42.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in ProseMirror's view component. Prior to version 1.42.3, the paste handling feature did not validate attributes from attacker-provided HTML in the clipboard slice context. When a user pastes such content, unvalidated attributes could execute malicious JavaScript in the editor's browser window.

Detection Guidance

To detect this vulnerability, check the version of ProseMirror's prosemirror-view component in use. If the version is below 1.42.3, the system is vulnerable. Commands like npm list prosemirror-view or checking package.json dependencies can help identify the installed version.

Impact Analysis

If exploited, an attacker could execute arbitrary JavaScript in your browser when you paste crafted HTML into a ProseMirror editor. This could lead to data theft, session hijacking, or unauthorized actions on your behalf within the application using the editor.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Exploitation may result in data breaches, triggering compliance violations and potential penalties.

Mitigation Strategies

Immediately update the prosemirror-view component to version 1.42.3 or later. This version includes the fix for the XSS vulnerability by validating attributes from clipboard content. No workarounds are available, so updating is the only mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104847. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart