PT-2025-46205 · Unknown · Prosemirror To Html

Published 2025-11-06 · Updated 2025-11-11 · CVE-2025-64501

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions ProsemirrorToHtml versions 0.2.0 and below

Description The prosemirror to html gem contains a flaw that allows for Cross-Site Scripting (XSS) attacks. This is due to improper handling of HTML attribute values during the conversion of ProseMirror-compatible JSON to HTML. While the content of HTML tags is correctly escaped, attribute values are not, enabling attackers to inject arbitrary JavaScript code. Applications utilizing prosemirror to html to convert ProseMirror documents to HTML, particularly those handling user-generated content, and end users viewing the resulting HTML output are potentially at risk.

Recommendations Update to version 0.2.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-64501

GHSA-52C5-VH7F-26FX

Affected Products

Prosemirror To Html

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64501.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/prosemirror_to_html/CVE-2025-64501.yml · Exploit
• https://osv.dev/vulnerability/GHSA-52c5-vh7f-26fx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64501 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64501 · Vendor Advisory
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/prosemirror_to_html/GHSA-vfpf-xmwh-8m65.yml · Note
• https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249 · Note
• https://github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8 · Note
• https://github.com/etaminstudio/prosemirror_to_html · Note
• https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx · Note
• https://twitter.com/CVEnew/status/1988003181394002227 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1988155314063937765 · Twitter Post