A Cross-Site Scripting vulnerability in the prosemirror_to_html gem allows authenticated attackers to execute arbitrary JavaScript in the context of a user's browser session.

This is a Cross-Site Scripting (CWE-79) vulnerability where the library fails to properly sanitize HTML attribute values during the conversion process. An authenticated attacker can provide malicious input that, when rendered by an application, executes unauthorized scripts in the victim's browser.

The successful exploitation of this vulnerability allows for the execution of malicious scripts within the context of an application session. This can lead to the theft of session cookies, sensitive user data exposure, or the performance of unauthorized actions on behalf of the user, resulting in potential reputational damage and loss of user trust. Given the CVSS score of 7.6, this is classified as a High severity issue that requires prioritized attention.

Immediate Action: Update the prosemirror_to_html gem to version 0.2.1 or later to implement the required attribute sanitization.

Proactive Monitoring: Review application logs for unusual characters or script tags within user-generated content entries that are processed by the library.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the sources from which scripts can be executed, which may mitigate the impact of successful XSS injections.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing the prosemirror_to_html gem should prioritize updating to version 0.2.1 immediately to resolve the identified sanitization flaw. Due to the potential for session hijacking and unauthorized data access, maintaining unpatched versions poses an unacceptable risk to application integrity and user security.