GHSA-52c5-vh7f-26fx: 
Ruby vulnerability analysis and mitigation

The prosemirror_to_html gem contains a Cross-Site Scripting (XSS) vulnerability (GHSA-52c5-vh7f-26fx) discovered and disclosed on November 6, 2025. The vulnerability affects versions prior to 0.2.1 and allows attackers to inject arbitrary JavaScript code through unescaped HTML attribute values. While the gem properly escapes tag content, it fails to sanitize attribute values, creating a potential security risk for applications converting ProseMirror documents to HTML (GitHub Advisory).

The vulnerability exists in the Renderer.render_opening_tag function within lib/prosemirror_to_html.rb, where HTML attribute values are directly concatenated into the output string without proper sanitization. The issue has been assigned a CVSS score of 7.6 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, and user interaction required. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (GitHub Advisory).

The vulnerability impacts any application using prosemirror_to_html to convert ProseMirror documents to HTML, with applications processing user-generated ProseMirror content at highest risk. Attack vectors include malicious javascript: protocol in href attributes, event handlers, onerror attributes on images, and other HTML attributes capable of executing JavaScript. End users viewing the rendered HTML output could have malicious JavaScript executed in their browsers (GitHub Advisory).

The vulnerability can be exploited through malicious HTML attribute values, particularly in applications that process user-generated ProseMirror content. The attack requires low complexity and privileges but does need user interaction. The vulnerability allows attackers to inject arbitrary JavaScript code through various HTML attributes (GitHub Advisory).

A fix has been released in version 0.2.1, which implements proper escaping of HTML attribute values using CGI.escapeHTML. Until upgrading is possible, several workarounds are available: 1) Sanitize output using libraries like Sanitize or Loofah, 2) Implement Content Security Policy (CSP) headers to prevent inline JavaScript execution, 3) Validate and sanitize ProseMirror documents before conversion. The recommended solution is to upgrade to version 0.2.1 or later (GitHub Advisory).