{"action":"Upgrade prosemirror_to_html to 0.2.1 or later.","affected":[{"fixed":"0.2.1","introduced":"0"}],"component":"prosemirror_to_html","cve_ids":["CVE-2025-64501"],"ecosystem":"RubyGems","epss":0.00237,"exploited":false,"fixed_versions":["0.2.1"],"ghsa_id":"GHSA-52c5-vh7f-26fx","id":"tcs_01M5KEGSNFVVTAB1BW5T3Y6PE2","modified_at":"2026-02-03T03:08:25.970585Z","published_at":"2025-11-06T15:44:35Z","references":["https://osv.dev/vulnerability/GHSA-52c5-vh7f-26fx","https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx","https://nvd.nist.gov/vuln/detail/CVE-2025-64501","https://github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8","https://github.com/etaminstudio/prosemirror_to_html","https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/prosemirror_to_html/CVE-2025-64501.yml","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/prosemirror_to_html/GHSA-vfpf-xmwh-8m65.yml"],"severity":{"label":"high","score":7.6},"sources":[{"source":"osv","source_id":"GHSA-52c5-vh7f-26fx","url":"https://osv.dev/vulnerability/GHSA-52c5-vh7f-26fx"}],"summary":"Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values"}