ProsemirrorToHtml: Cross-Site Scripting vulnerability through unescaped HTML attribute values
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the `prosemirror_to_html` gem is vulnerable to Cross-Site Scripting (XSS) attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values are not, allowing attackers to inject arbitrary JavaScript code. Applications that use `prosemirror_to_html` to convert ProseMirror documents to HTML, user-generated ProseMirror content, and end users viewing the rendered HTML output are all at risk of attack. This issue is fixed in version 0.2.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| etaminstudio | prosemirror_to_html | before 0.2.1 | 0.2.1 | Patch available | CNA |
| — | prosemirror_to_html (RubyGems) | before 0.2.1 | 0.2.1 | Patch available | GHSA-52c5-vh7f-26fx |
- prosemirror_to_html Vendoretaminstudio Affected before 0.2.1 Fixed in 0.2.1 Patch available CNA
- prosemirror_to_html (RubyGems) Vendor— Affected before 0.2.1 Fixed in 0.2.1 Patch available GHSA-52c5-vh7f-26fx
Remediation
- Fix · CNA prosemirror_to_html (etaminstudio) Fixed in 0.2.1
- Fix · GHSA-52c5-vh7f-26fx prosemirror_to_html (RubyGems) Fixed in 0.2.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-64501
- 2026-10-03 Alias added: GHSA-52c5-vh7f-26fx
References
Other 6
- https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx
- https://github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8
- https://github.com/etaminstudio/prosemirror_to_html
- https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/prosemirror_to_html/CVE-2025-64501.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/prosemirror_to_html/GHSA-vfpf-xmwh-8m65.yml
Sources
- CVE-2025-64501 · CVE Program
- CVE-2025-64501 · NVD
- FIRST EPSS
- GHSA-52c5-vh7f-26fx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences