Reflected cross-site scripting (XSS) In prosemirror-view
Description
ProseMirror has a XSS vulnerability in prosemirror-view's paste handling
Impact
When a user pastes attacker-provided HTML into a ProseMirror editor component, this can cause attacker-controlled JavaScript code to run in the browser window containing the editor.
Patches
Version 1.42.3 adds validation that prevents this attack.
Workarounds
No known workarounds.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 npm | 1.42.3 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3.