CVE-2026-104847 in View
Summary
by MITRE • 10/02/2026
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. When a user pastes the crafted HTML into an editor, the unvalidated context attributes can construct content that executes attacker-controlled JavaScript in the browser window containing the editor. This issue is fixed in version 1.42.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified within ProseMirror versions prior to 1.42.3 represents a critical failure in input validation during the paste operation, specifically affecting the view component responsible for rendering and managing editable browser interfaces. This flaw allows an attacker to inject malicious content by exploiting how clipboard data is processed when users paste HTML into a document editor. The core technical issue lies in the handling of attributes within the clipboard slice context; these attributes bypass schema-based validation mechanisms that are typically designed to sanitize input and ensure compliance with predefined structural rules. Consequently, any attribute present in the pasted HTML content is rendered directly without sufficient scrutiny regarding its safety or adherence to expected data types, creating a direct pathway for cross-site scripting attacks.
From an operational perspective, this vulnerability enables attackers to execute arbitrary JavaScript code within the context of the victim's browser window where the ProseMirror editor is active. When a user pastes crafted HTML containing malicious scripts, such as event handlers or script tags with encoded payloads, the unvalidated attributes facilitate the construction of content that triggers immediate execution upon rendering. This capability allows for severe security implications including session hijacking through cookie theft, credential harvesting via fake login forms injected into the editor interface, and potential defacement of the document content. The attack vector is particularly dangerous because it relies on social engineering tactics where a victim unknowingly pastes maliciously formatted clipboard data, often disguised as legitimate text or rich media from external sources.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation known commonly as Cross-site Scripting (XSS). The specific mechanism involves the failure to validate attributes against a strict schema before rendering, falling under CWE-20 where improper input validation leads to security vulnerabilities. In terms of tactical classification within the MITRE ATT&CK framework, this behavior corresponds to T1189 Drive-by Compromise or more specifically techniques related to Client-side Injection such as T1059 Command and Scripting Interpreter via browser-based execution vectors like DOM-based XSS. The lack of attribute validation means that standard sanitization libraries may not catch these specific contextual anomalies unless explicitly configured to handle clipboard slice contexts with rigorous schema enforcement.
To mitigate this risk, organizations must immediately upgrade ProseMirror to version 1.42.3 or later where the paste handling logic has been corrected to enforce strict schema attribute validation for all incoming HTML content from clipboard operations. For environments unable to patch instantly due to dependency constraints, implementing additional client-side sanitization layers using robust libraries like DOMPurify can provide a temporary buffer against malicious payloads. It is also advisable to configure Content Security Policy headers with restrictive nonce-based or hash-based policies to limit the execution of inline scripts even if they are successfully injected into the DOM. Regular security audits focusing on rich text editor configurations and clipboard handling mechanisms should be conducted to ensure that no other components bypass validation protocols, thereby maintaining a defense-in-depth posture against client-side injection attacks.