CVE-2026-104847: ProseMirror: XSS vulnerability in prosemirror-view's paste handling

Q: Which deployments are affected?

Deployments using prosemirror-view versions earlier than 1.42.3 are affected. The issue is in the view component's paste handling.

Q: What must an attacker do to trigger the vulnerability?

An attacker must provide crafted HTML with clipboard slice context attributes that bypass schema attribute validation. A user must then paste that HTML into a ProseMirror editor.

Q: Is authentication required to exploit this issue?

No attacker privileges are required, but exploitation requires user interaction: the target user must paste the crafted HTML into the editor.

Q: What is the impact after successful exploitation?

The crafted content can execute attacker-controlled JavaScript in the browser window that contains the editor. The stated CVSS impact includes high confidentiality and integrity impact.

Q: What is the remediation?

Upgrade prosemirror-view to version 1.42.3, which fixes the paste-handling issue.

Published Oct 2, 2026

Updated

ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. When a user pastes the crafted HTML into an editor, the unvalidated context attributes can construct content that executes attacker-controlled JavaScript in the browser window containing the editor. This issue is fixed in version 1.42.3.

Affected Software

1 affected component

npm/prosemirror-view<1.42.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade prosemirror-view to a version that resolves this vulnerability.
Fixed in 1.42.3

Event History

Oct 2, 2026

CVE Published

via MITRE·04:02 PM

Data Sourced

via MITRE·04:02 PM

DescriptionWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments using prosemirror-view versions earlier than 1.42.3 are affected. The issue is in the view component's paste handling.

What must an attacker do to trigger the vulnerability?

An attacker must provide crafted HTML with clipboard slice context attributes that bypass schema attribute validation. A user must then paste that HTML into a ProseMirror editor.

Is authentication required to exploit this issue?

No attacker privileges are required, but exploitation requires user interaction: the target user must paste the crafted HTML into the editor.

What is the impact after successful exploitation?

The crafted content can execute attacker-controlled JavaScript in the browser window that contains the editor. The stated CVSS impact includes high confidentiality and integrity impact.

What is the remediation?

Upgrade prosemirror-view to version 1.42.3, which fixes the paste-handling issue.

CVE-2026-104847: ProseMirror: XSS vulnerability in prosemirror-view's paste handling

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to trigger the vulnerability?

Is authentication required to exploit this issue?

What is the impact after successful exploitation?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to trigger the vulnerability?

Is authentication required to exploit this issue?

What is the impact after successful exploitation?

What is the remediation?