Executive brief
@udecode/plate-link is a rich-text editor component for React that allows users to insert links. The vulnerability allows attackers to inject JavaScript URLs (e.g., javascript:void(0)) into links, enabling cross-site scripting (XSS) attacks when links are opened or pasted into the editor. An attacker can exploit this to steal user data, hijack sessions, or perform actions on behalf of the user.
Technical details
This is a cross-site scripting (CWE-79) vulnerability in the link plugin of @udecode/plate-link. The root cause is insufficient input validation on URL schemes before rendering anchor elements to the DOM. Attackers can insert links with javascript: URLs through multiple vectors including manual link creation or pasting malicious content (both as text and HTML). The vulnerability requires user interaction to exploit (user must click or paste content) but has no authentication requirement and is network-accessible. An attacker can achieve arbitrary JavaScript execution in the context of the application, potentially leading to session hijacking or data theft. Version 20.0.0 patches this by introducing a sanitizeUrl utility and an allowedSchemes configuration option that validates URL schemes before rendering.
Affected products
- udecode @udecode/plate-link <20.0.0
Timeline
- 2023-06-09: disclosed: Security advisory published
- 2023-06-09: patched: Version 20.0.0 released with fix