CVE-2026-104847

ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. When a user pastes the crafted HTML into an editor, the unvalidated context attributes can construct content that executes attacker-controlled JavaScript in the browser window containing the editor. This issue is fixed in version 1.42.3.

• CWE-79

• https://github.com/ProseMirror/prosemirror-view/commit/20dc0a911a79f8fc6640dbbea5e7d68d3c4784b7
• https://github.com/ProseMirror/prosemirror-view/commit/2e91a612bbc1248e55b4f6061fc93fe459f977c1
• https://github.com/ProseMirror/prosemirror-view/security/advisories/GHSA-c8x8-7fp4-3x9w
• https://github.com/ProseMirror/prosemirror-view/security/advisories/GHSA-c8x8-7fp4-3x9w
• https://github.com/ProseMirror/prosemirror-view/security/advisories/GHSA-c8x8-7fp4-3x9w
• https://github.com/ProseMirror/prosemirror-view/security/advisories/GHSA-c8x8-7fp4-3x9w

Published

Oct 2, 2026

Last Modified

Oct 2, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104733User Impersonation in ProcessOnes XMMP Server ejabberd <= 26…7.4
• CVE-2026-1048A weakness has been identified in LigeroSmart up to 6.1.26. …5.4
• CVE-2026-104843uv is a Python package and project manager written in Rust. …5.9
• CVE-2026-104844PostCSS Selector Parser is a CSS selector parser that integr…5.9
• CVE-2026-104845Seroval facilitates JS value stringification, including comp…7.5
• CVE-2026-104846Seroval facilitates JS value stringification, including comp…9.8
• CVE-2026-104848Tinypool is a minimal Node.js worker thread pool implementat…9.5
• CVE-2026-104849Tinypool is a minimal Node.js worker thread pool implementat…9.5
• CVE-2026-104851fsspec is a specification and Python implementation framewor…8.8
• CVE-2026-104853Nx is a monorepo solution for TypeScript and polyglot codeba…5.8
• CVE-2026-104854Nx is a monorepo solution for TypeScript and polyglot codeba…8.5
• CVE-2026-104855Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.…2