Executive brief
@platejs/docx-io, a library used to convert HTML documents to DOCX format, can be exploited to make unintended outbound network requests to internal or external servers when processing untrusted HTML. An attacker can craft malicious HTML with remote image references that causes the server to fetch and embed sensitive response data into the generated DOCX file, exposing information from internal networks or services.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) with response disclosure in the @platejs/docx-io library affecting versions ≤ 53.1.0. The vulnerable component automatically fetches and processes remote image URLs while converting HTML to DOCX format without sufficient validation. When an application processes attacker-controlled HTML in a server-side or privileged environment, this allows an attacker to embed arbitrary image URLs (including internal network addresses) that the server will fetch. The fetched image data is then included in the generated DOCX output, potentially exposing sensitive information. The attack requires no authentication or user interaction and is network-accessible. A patch is available in version 53.3.2, which disables remote image fetching by default and requires explicit opt-in via the `allowRemoteImages: true` parameter only when processing trusted HTML.
Affected products
- udecode @platejs/docx-io < 53.3.2
Timeline
- 2026-07-03: disclosed
- 2026-07-03: patched: Version 53.3.2 released with fix