CVE-2025-64501 ProsemirrorToHtml: Cross-Site Scripting vulnerability through unescaped HTML attribute values
Attackers can inject arbitrary JavaScript via unescaped HTML attributes in ProseMirror JSON conversions, risking user sessions in applications using this Ruby gem.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-64501?
CVE-2025-64501 is a high-severity cross-site scripting vulnerability in etaminstudio prosemirror_to_html, published on 10 Nov 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the `prosemirror_to_html` gem is vulnerable to Cross-Site Scripting (XSS) attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values are not, allowing attackers to inject arbitrary JavaScript code. Applications that use `prosemirror_to_html` to convert ProseMirror documents to HTML, user-generated ProseMirror content, and end users viewing the rendered HTML output are all at risk of attack. This issue is fixed in version 0.2.1.
Weakness: CWE-79
Which versions are affected by CVE-2025-64501?
2 open source packages ship an affected version, including prosemirror_to_html.
| Package | Affected | Fixed in |
|---|---|---|
prosemirror_to_html RubyGems | All versions | 0.2.1 |
prosemirror_to_html RubyGems | All versions | 0.2.1 |
How do I fix CVE-2025-64501?
Upgrade prosemirror_to_html to 0.2.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-64501 being exploited?
There is no known exploitation of CVE-2025-64501 in the wild and no public exploit code.
Sources
Also known as GHSA-52c5-vh7f-26fx.