Packages / prosemirror-view / Security

HighVulnerabilityGHSA-c8x8-7fp4-3x9wCVE-2026-104847Published 5 Oct 2026

ProseMirror has a XSS vulnerability in prosemirror-view's paste handling

Affected releases · prosemirror-view

  • 1.x1.0.0 – 1.42.2Fixed in 1.42.3
  • 0.24.x and older0.11.0 – 0.24.0No fix, no longer updated

On 1.x, the newest line:

npm install prosemirror-view@1.42.3
1.x

  1. Affected

    1.0.0 – 1.42.2

    252 releases

  2. Fixed

    1.42.3 – 1.42.7

    5 releases

0.x

  1. Affected

    0.11.0 – 0.24.0

    44 releases

301 stable releases of prosemirror-view, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for prosemirror-view. It is read in your browser and sent nowhere.

What happens

Impact

When a user pastes attacker-provided HTML into a ProseMirror editor component, this can cause attacker-controlled JavaScript code to run in the browser window containing the editor.

Patches

Version 1.42.3 adds validation that prevents this attack.

Workarounds

No known workarounds.