CVE-2026-65842: Plate: SSRF with response disclosure in DOCX image embedding
Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the fetched image bytes in the generated DOCX, allowing server-side request forgery with response disclosure. Applications can also incur resource consumption from attacker-selected remote responses. This issue is fixed in version 53.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@platejs/docx-ioto a version that resolves this vulnerability.Fixed in 53.3.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using @platejs/docx-io before version 53.3.2 are exposed when they convert attacker-controlled HTML with htmlToDocxBlob in a server-side or otherwise privileged environment. The affected conversion path fetches remote image URLs.
What does an attacker need to exploit it?
An attacker needs to supply HTML that is processed by htmlToDocxBlob and contains image URLs they control or choose. No authentication or user interaction is required according to the provided severity vector.
What could an attacker obtain through the generated document?
The converter can request internal network resources and embed the fetched image bytes in the generated DOCX. This can disclose responses from resources reachable by the server or privileged environment.
What is the remediation?
Upgrade @platejs/docx-io to version 53.3.2, which fixes the issue. The provided data does not specify an alternative mitigation for environments where upgrading is delayed.