GHSA-qrfj-mgw8-j9c6: XSS
Summary
HTML strings passed to Plate's core deserialization APIs were parsed in the active document. Certain HTML attributes could therefore trigger browser behavior during parsing, before the content was converted into editor nodes.
Applications that deserialize HTML from untrusted or cross-user sources may be affected.
Impact
An attacker who can control HTML later deserialized in another user's browser may be able to execute script in that application's origin.
Remediation
Upgrade to @platejs/core 53.3.11 or later. Users of the discontinued 54.0.0 beta builds should install the fixed stable line. Applications should also sanitize untrusted HTML before rendering it; inert parsing is not a substitute for sanitization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@platejs/coreto a version that resolves this vulnerability.Fixed in 53.3.11 - Upgrade
Upgrade
@platejs/coreto a version that resolves this vulnerability.Fixed in 53.3.11
Event History
Frequently Asked Questions
Which applications are exposed?
Applications using @platejs/core that deserialize HTML from untrusted or cross-user sources in another user's browser may be affected. The attacker must be able to control HTML that is later deserialized by a victim.
What attacker interaction is required?
The attacker does not need privileges, but a user must cause the attacker-controlled HTML to be deserialized in their browser. Malicious HTML attributes can trigger browser behavior during parsing, before conversion into editor nodes.
What should be done if upgrading is not immediately possible?
Sanitize all untrusted HTML before it is rendered or deserialized. Inert parsing alone is not considered a replacement for sanitization.
Which versions should be used for remediation?
Upgrade @platejs/core to version 53.3.11 or later. Users on the discontinued 54.0.0 beta builds should move to the fixed stable line.