CVE-2025-64501 Details
Description
ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the `prosemirror_to_html` gem is vulnerable to Cross-Site Scripting (XSS) attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values are not, allowing attackers to inject arbitrary JavaScript code. Applications that use `prosemirror_to_html` to convert ProseMirror documents to HTML, user-generated ProseMirror content, and end users viewing the rendered HTML output are all at risk of attack. This issue is fixed in version 0.2.1.
A Cross-Site Scripting (XSS) vulnerability has been identified in the ProsemirrorToHtml gem, specifically in versions prior to 0.2.1. The issue arises because HTML attribute values are not properly escaped, allowing attackers to inject arbitrary JavaScript. While the content within tags is safe, attributes can be exploited to execute malicious scripts. This vulnerability affects any application that uses ProsemirrorToHtml to convert ProseMirror documents into HTML, particularly those handling user-generated content. End users viewing the resulting HTML may also be at risk, as the injected scripts could be executed in their browsers.
Users are advised to upgrade to ProsemirrorToHtml version 0.2.1 or later, where this vulnerability has been fixed by escaping all HTML attribute values. Additionally, applications can sanitize the HTML output using a library like Sanitize or Loofah, implement a strict Content Security Policy to block inline JavaScript execution, and validate ProseMirror documents before conversion to remove any malicious content.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 10, 2025CISA-ADP
Assessed Nov 12, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8 | [email protected] | Source CodeVendor |
| https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| etaminstudio prosemirror_to_html | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 10, 2025 | New CVE Received | [email protected] |