CVE-2026-55596

Published: Jul 8, 2026Modified: Jul 10, 2026Deferred

8.7

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Exploitability: 2.3 / Impact: 5.8

Source: security-advisories@github.com (Secondary)

Description

Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as a javascript: iframe source that the registry MediaEmbedElement renders directly as an iframe src when a victim opens the document. This issue is fixed in version 53.1.4.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (5)

https://github.com/udecode/plate/commit/6214914ca811adf22d0ad503154494216eed68ba

Source: security-advisories@github.com

https://github.com/udecode/plate/pull/5014

Source: security-advisories@github.com

https://github.com/udecode/plate/releases/tag/v53.1.4

Source: security-advisories@github.com

https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv

Source: security-advisories@github.com

https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.