CVE-2026-88976: @platejs/core HTML deserialization can trigger browser behavior during parsing
Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs, certain HTML attributes can trigger browser behavior before the HTML is converted into editor nodes. This can allow attacker-controlled script to execute in the consuming application's origin when another user loads the deserialized content. This issue is fixed in version 53.3.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@platejs/coreto a version that resolves this vulnerability.Fixed in 53.3.11 - Configuration
Do not supply untrusted or cross-user HTML strings to the Plate core HTML deserialization APIs that parse supplied HTML strings in the active document, since certain HTML attributes can trigger browser behavior before conversion into editor nodes.
@platejs/core HTML deserialization APIs input_validation = disable untrusted/cross-user HTML input - Compensating control
If your application passes untrusted or cross-user HTML to Plate core HTML deserialization APIs, treat the HTML as untrusted and prevent attacker-controlled HTML from being supplied (e.g., block/avoid calling these APIs with untrusted HTML).
Event History
Frequently Asked Questions
Which applications are exposed?
Applications using affected @platejs/core HTML deserialization APIs are exposed when they pass untrusted or cross-user HTML strings to those APIs and another user later loads the deserialized content. The browser behavior occurs in the consuming application's origin.
Does exploitation require an attacker to be authenticated or require a victim action?
No attacker privileges are required according to the vector, but exploitation requires user interaction. A user must load content that was deserialized from attacker-controlled HTML.
Are default deployments necessarily affected?
Not necessarily. Exposure depends on whether the application supplies untrusted or cross-user HTML to the affected deserialization APIs; the provided information does not establish that this occurs in a default configuration.
What versions should be remediated?
Upgrade to @platejs/core version 53.3.11, which fixes the issue. Versions before 53.3.11 and the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds are affected.