CVE-2025-64501

ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the `prosemirror_to_html` gem is vulnerable to Cross-Site Scripting (XSS) attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values are not, allowing attackers to inject arbitrary JavaScript code. Applications that use `prosemirror_to_html` to convert ProseMirror documents to HTML, user-generated ProseMirror content, and end users viewing the rendered HTML output are all at risk of attack. This issue is fixed in version 0.2.1.

• CWE-79

• https://github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8
• https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx

Published

Nov 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64496Open WebUI is a self-hosted artificial intelligence platform…8
• CVE-2025-64497Tuleap is an Open Source Suite for management of software de…6.5
• CVE-2025-64498Tuleap is an Open Source Suite for management of software de…4.3
• CVE-2025-64499Tuleap is a free and open source suite for management of sof…5.4
• CVE-2025-6450A vulnerability was found in code-projects Simple Online Hot…9.8
• CVE-2025-64500Symfony is a PHP framework for web and console applications …7.3
• CVE-2025-64502Parse Server is an open source backend that can be deployed …6.9
• CVE-2025-64503cups-filters contains backends, filters, and other software …3.3
• CVE-2025-64504Langfuse is an open source large language model engineering …5
• CVE-2025-64505LIBPNG is a reference library for use in applications that r…6.1
• CVE-2025-64506LIBPNG is a reference library for use in applications that r…6.1
• CVE-2025-64507Incus is a system container and virtual machine manager. An …7.8