Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

prosemirror_to_html

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.6RubyGemsPublished

    Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values

    CVE-2025-64501 · GHSA-52c5-vh7f-26fx

    Affected
    • RubyGems prosemirror_to_html < 0.2.1
    Fixed in
    0.2.1· Vendor fix available
    Issue
    Impact The prosemirrortohtml gem is vulnerable to Cross-Site Scripting (XSS) attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values are not, allowing attackers to inject arbitrary JavaScript code. Who is impacted: - Any application using prosemirrortohtml to convert ProseMirror documents to HTML - Applications that process user-generated ProseMirror content are at highest risk - End users viewing the rendered HTML output could have malicious JavaScript executed in their browsers Attack vectors include: - href attributes with javascript: protocol: <a href="javascript:alert(document.cookie)" - Event handlers: <div onclick="maliciousCode()" - onerror attributes on images: <img src=x onerror="alert('XSS')" - Other HTML attributes that can execute JavaScript Patches A fix is currently in development. Users should upgrade to version 0.2.1 or later once released. The patch escapes all HTML attribute values using CGI.escapeHTML to prevent…

    Recommended action: Upgrade to 0.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →