HTML Injection Vulnerability in ProseMirror View Component

CVE-2026-104847

What is CVE-2026-104847?

The ProseMirror view component, responsible for rendering the editable interface for ProseMirror documents, contains a vulnerability allowing for HTML injection. Specifically, in versions prior to 1.42.3, the paste functionality of the editor fails to validate attributes from pasted HTML. This vulnerability can be exploited when a user pastes manipulated HTML, which may include attributes capable of executing malicious JavaScript in the context of the user's browser. The issue has been addressed in version 1.42.3, which enforces stricter validation of pasted content attributes.

References