-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the prosemirror_to_html gem, specifically in how it constructs HTML tags from a ProseMirror document. The analysis of the patch in commit 4d59f94f550bcabeec30d298791bbdd883298ad8 reveals that the render_opening_tag function in lib/prosemirror_to_html.rb was modified. Before the patch, this function directly concatenated attribute values into the HTML string. The line - attrs << " #{attr}=\"#{value}\"" shows that the value is not sanitized or escaped. This allows an attacker to craft a ProseMirror document with malicious attribute values (e.g., href="javascript:alert(1)" or onerror="alert(1)"). When ProsemirrorToHtml.render is called on this document, the render_opening_tag function will be executed, creating a malicious HTML tag and leading to a Cross-Site Scripting (XSS) vulnerability. The patch fixes this by introducing escaped_value = CGI.escapeHTML(value.to_s) and using this escaped value instead, thus neutralizing the vulnerability. Therefore, ProsemirrorToHtml::Renderer.render_opening_tag is the key vulnerable function that would appear in a runtime profile during exploitation.
ProsemirrorToHtml::Renderer.render_opening_taglib/prosemirror_to_html.rb
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| prosemirror_to_html | rubygems | < 0.2.1 | 0.2.1 |
Ongoing coverage of React2Shell