Executive brief
Plate is a JavaScript library for building rich text editors. The library's HTML deserialization feature was parsing HTML strings directly in the active document, allowing certain HTML attributes to trigger unintended browser behavior before content was converted to editor nodes. An attacker who controls HTML content (e.g., from a malicious paste, shared document, or cross-user source) could execute arbitrary JavaScript in the victim's browser within the application's security context.
Technical details
The vulnerability is an improper input handling flaw (CWE-79, Cross-Site Scripting) in @platejs/core's deserialization APIs. When HTML strings are passed to these APIs, they were parsed in the active DOM document rather than an inert context, allowing certain HTML attributes (such as event handlers or other browser-triggered mechanisms) to fire during parsing, before the content was sanitized and converted into editor nodes. Attack requires network reachability and user interaction (the victim must trigger deserialization of attacker-controlled HTML). An attacker can achieve arbitrary script execution in the application's origin. The vulnerability was fixed in version 53.3.11 and users of the 54.0.0-beta.0 and 54.0.0-beta.1 builds should upgrade to the stable line.
Affected products
- Udecode @platejs/core < 53.3.11, >= 54.0.0-beta.0 and <= 54.0.0-beta.1
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Version 53.3.11 released
- 2026-09-16: advisory: NVD published
- 2026-09-17: advisory: GitHub Advisory Database published