etaminstudio prosemirror_to_html up to 0.2.0 cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, has been found in etaminstudio prosemirror_to_html up to 0.2.0. Affected by this vulnerability is the function prosemirror_to_html. Performing a manipulation results in cross site scripting. This vulnerability is known as CVE-2025-64501. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in etaminstudio prosemirror_to_html up to 0.2.0. This affects the function prosemirror_to_html. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the `prosemirror_to_html` gem is vulnerable to Cross-Site Scripting (XSS) attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values are not, allowing attackers to inject arbitrary JavaScript code. Applications that use `prosemirror_to_html` to convert ProseMirror documents to HTML, user-generated ProseMirror content, and end users viewing the rendered HTML output are all at risk of attack. This issue is fixed in version 0.2.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-64501 since 11/05/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

Upgrading to version 0.2.1 eliminates this vulnerability. Applying the patch 4d59f94f550bcabeec30d298791bbdd883298ad8 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-38038). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• etaminstudio

Name

• prosemirror_to_html

Version

• 0.1
• 0.2.0

License

• open-source

Website

• Product: https://github.com/etaminstudio/prosemirror_to_html/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion