GHSA-4q39-2jhr-7qx8: SSRF
Summary
@platejs/docx-io can fetch remote image URLs while converting HTML to DOCX. When an application converts attacker-controlled HTML in a server-side or privileged environment, this can cause the application environment to make unintended outbound requests and include fetched image data in the generated DOCX.
Impact
Applications are affected when they use @platejs/docx-io to convert untrusted HTML that may contain remote image references, especially in server-side conversion workflows or environments with access to internal network resources.
Affected package:
- @platejs/docx-io versions < 53.3.2
Patched versions
Upgrade to @platejs/docx-io version 53.3.2 or later.
Workarounds
If you cannot upgrade immediately, do not pass untrusted HTML with remote image URLs to DOCX export. Sanitize untrusted HTML to remove remote image references, convert trusted images to data URIs before conversion, or run conversion in an environment with restricted outbound network access.
Credits
Thanks to EQSTLab for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@platejs/docx-ioto a version that resolves this vulnerability.Fixed in 53.3.2 - Upgrade
Upgrade
@platejs/docx-ioto a version that resolves this vulnerability.Fixed in 53.3.2 - Configuration
If you cannot upgrade immediately, avoid sending untrusted HTML that contains remote image references to @platejs/docx-io DOCX export.
DOCX export workflow HTML input handling for remote image URLs = Do not pass untrusted HTML with remote image URLs to DOCX export - Configuration
Sanitize untrusted HTML to remove remote image references; for trusted images, convert them to data URIs prior to DOCX conversion.
HTML sanitization before conversion Remote image references = Remove remote image references (or convert trusted images to data URIs) before conversion - Compensating control
Run the HTML-to-DOCX conversion in an environment with restricted outbound network access so remote image fetching cannot reach internal networks.
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Applications that use @platejs/docx-io before version 53.3.2 to convert attacker-controlled HTML are affected, particularly server-side or privileged conversion environments that can reach internal network resources.
What does an attacker need to exploit it?
An attacker needs to supply HTML that is passed to the DOCX conversion workflow and contains remote image references. No authentication or user interaction is indicated by the provided severity vector.
Are applications that only convert trusted HTML affected in practice?
The described risk is tied to untrusted HTML containing remote image URLs. Workflows limited to trusted HTML do not match the stated affected scenario.
What can be done before upgrading?
Do not send untrusted HTML with remote image URLs to DOCX export. Remove remote image references during HTML sanitization, convert trusted images to data URIs, or restrict outbound network access for the conversion environment.
How can I determine whether my application is affected?
Check whether your application uses @platejs/docx-io below 53.3.2 and whether its DOCX export path accepts untrusted HTML that can include remote image references. Review the network permissions of the environment performing conversion, especially its ability to access internal resources.