Skip to content

Commit 1777fa7

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@5000a10 
1 parent 18192f2 commit 1777fa7

File tree

4 files changed

+173
-0
lines changed

4 files changed

+173
-0
lines changed

‎advisories/_posts/2019-10-07-CVE-2024-22050.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ advisory:
4141
### For more information
4242
If you have any questions or comments about this advisory:
4343
* Email [Boaz Segev](https://github.com/boazsegev)
44+
cvss_v3: 7.5
4445
patched_versions:
4546
- ">= 0.7.34"
4647
related:

‎advisories/_posts/2023-04-11-CVE-2024-22048.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ advisory:
3333
### Patches
3434
3535
This has been fixed in v3.3.1. HTML is now sanitised in search results.
36+
cvss_v3: 6.1
3637
unaffected_versions:
3738
- "< 2.0.2"
3839
patched_versions:

‎advisories/_posts/2025-11-06-CVE-2025-64501.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2025-64501 (prosemirror_to_html): Cross-Site Scripting (XSS) vulnerability
4+
through unescaped HTML attribute values'
5+
comments: false
6+
categories:
7+
- prosemirror_to_html
8+
advisory:
9+
gem: prosemirror_to_html
10+
cve: 2025-64501
11+
ghsa: 52c5-vh7f-26fx
12+
url: https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx
13+
title: Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute
14+
values
15+
date: 2025-11-06
16+
description: |
17+
### Impact
18+
19+
The prosemirror_to_html gem is vulnerable to Cross-Site Scripting
20+
(XSS) attacks through malicious HTML attribute values. While tag
21+
content is properly escaped, attribute values are not, allowing
22+
attackers to inject arbitrary JavaScript code.
23+
24+
**Who is impacted:**
25+
26+
- Any application using prosemirror_to_html to convert ProseMirror
27+
documents to HTML
28+
- Applications that process user-generated ProseMirror content are
29+
at highest risk
30+
- End users viewing the rendered HTML output could have malicious
31+
JavaScript executed in their browsers
32+
33+
**Attack vectors include:**
34+
35+
- `href` attributes with `javascript:` protocol: `<a href="javascript:alert(document.cookie)">`
36+
- Event handlers: `<div onclick="maliciousCode()">`
37+
- `onerror` attributes on images: `<img src=x onerror="alert('XSS')">`
38+
- Other HTML attributes that can execute JavaScript
39+
40+
### Patches
41+
42+
A fix is currently in development. Users should upgrade to
43+
version **0.2.1** or later once released.
44+
45+
The patch escapes all HTML attribute values using `CGI.escapeHTML`
46+
to prevent injection attacks.
47+
48+
### Workarounds
49+
50+
Until a patched version is available, users can implement one or
51+
more of these mitigations:
52+
53+
1. **Sanitize output**: Pass the HTML output through a sanitization
54+
library like [Sanitize](https://github.com/rgrove/sanitize) or
55+
[Loofah](https://github.com/flavorjones/loofah):
56+
57+
```ruby
58+
html = ProsemirrorToHtml.render(document)
59+
safe_html = Sanitize.fragment(html, Sanitize::Config::RELAXED)
60+
```
61+
62+
2. **Implement Content Security Policy (CSP)**: Add strict CSP
63+
headers to prevent inline JavaScript execution:
64+
65+
```
66+
Content-Security-Policy: default-src 'self'; script-src 'self'
67+
```
68+
69+
3. **Input validation**: If possible, validate and sanitize ProseMirror
70+
documents before conversion to prevent malicious content from
71+
entering the system.
72+
73+
### References
74+
75+
- Vulnerable code: https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249
76+
- [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)
77+
- [CWE-79: Improper Neutralization of Input During Web Page Generation](https://cwe.mitre.org/data/definitions/79.html)
78+
cvss_v3: 7.6
79+
patched_versions:
80+
- ">= 0.2.1"
81+
related:
82+
url:
83+
- https://nvd.nist.gov/vuln/detail/CVE-2025-64501
84+
- https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx
85+
- https://github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8
86+
- https://github.com/advisories/GHSA-52c5-vh7f-26fx
87+
---

‎advisories/_posts/2025-11-13-GHSA-4249-gjr8-jpq3.md‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-4249-gjr8-jpq3 (prosemirror_to_html): ProsemirrorToHtml has a Cross-Site
4+
Scripting (XSS) vulnerability through unescaped HTML attribute values'
5+
comments: false
6+
categories:
7+
- prosemirror_to_html
8+
advisory:
9+
gem: prosemirror_to_html
10+
ghsa: 4249-gjr8-jpq3
11+
url: https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx
12+
title: ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability through
13+
unescaped HTML attribute values
14+
date: 2025-11-13
15+
description: |
16+
### Impact
17+
18+
The prosemirror_to_html gem is vulnerable to Cross-Site Scripting
19+
(XSS) attacks through malicious HTML attribute values. While tag
20+
content is properly escaped, attribute values are not, allowing
21+
attackers to inject arbitrary JavaScript code.
22+
23+
**Who is impacted:**
24+
25+
- Any application using prosemirror_to_html to convert ProseMirror
26+
documents to HTML
27+
- Applications that process user-generated ProseMirror content are
28+
at highest risk
29+
- End users viewing the rendered HTML output could have malicious
30+
JavaScript executed in their browsers
31+
32+
**Attack vectors include:**
33+
34+
- `href` attributes with `javascript:` protocol:
35+
`<a href="javascript:alert(document.cookie)">`
36+
- Event handlers: `<div onclick="maliciousCode()">`
37+
- `onerror` attributes on images: `<img src=x onerror="alert('XSS')">`
38+
- Other HTML attributes that can execute JavaScript
39+
40+
### Patches
41+
42+
A fix is currently in development. Users should upgrade to version
43+
**0.2.1** or later once released. The patch escapes all HTML attribute
44+
values using `CGI.escapeHTML` to prevent injection attacks.
45+
46+
### Workarounds
47+
48+
Until a patched version is available, users can implement one or
49+
more of these mitigations:
50+
51+
1. **Sanitize output**: Pass the HTML output through a sanitization
52+
library like [Sanitize](https://github.com/rgrove/sanitize) or
53+
[Loofah](https://github.com/flavorjones/loofah):
54+
55+
```ruby
56+
html = ProsemirrorToHtml.render(document)
57+
safe_html = Sanitize.fragment(html, Sanitize::Config::RELAXED)
58+
```
59+
60+
2. **Implement Content Security Policy (CSP)**: Add strict CSP
61+
headers to prevent inline JavaScript execution:
62+
```
63+
Content-Security-Policy: default-src 'self'; script-src 'self'
64+
```
65+
66+
3. **Input validation**: If possible, validate and sanitize
67+
ProseMirror documents before conversion to prevent malicious
68+
content from entering the system.
69+
70+
### References
71+
72+
- Vulnerable code: https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249
73+
- [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)
74+
patched_versions:
75+
- ">= 0.2.1"
76+
related:
77+
url:
78+
- https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx
79+
- https://github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8
80+
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
81+
- https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249
82+
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/prosemirror_to_html/GHSA-vfpf-xmwh-8m65.yml
83+
- https://github.com/advisories/GHSA-4249-gjr8-jpq3
84+
---

0 commit comments

Comments
 (0)