GHSA-52c5-vh7f-26fx
High · 7.6CVSS
7.6
EPSS
—
Published
Nov 6, 2025
CISA due date
—
The record
Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| RubyGems | prosemirror_to_html | 0 | 0.2.1 |
Related vulnerabilities
- CVE-2025-64501 ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs… Same vulnerability
- GHSA-4249-gjr8-jpq3 Duplicate Advisory: ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability… Also affects prosemirror_to_html
- GHSA-vfpf-xmwh-8m65 Duplicate Advisory: ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability… Also affects prosemirror_to_html
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79