CVE-2026-55596

HighCVSS 8.7

Published: 08/07/2026(UTC)Updated: 10/07/2026(UTC)Translated: 11/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

A vulnerability in the Plate rich-text editor (versions 53.0.0 to 53.1.4) allows JavaScript injection via embedded media. An attacker can craft a document that, when opened by a victim, renders an iframe with JavaScript code instead of a safe video source.

Risk Assessment

The risk involves arbitrary JavaScript execution in the victim's browser context, potentially leading to data theft, session hijacking, or other XSS attacks.

Recommendation

Immediately update the Plate library to version 53.1.4 or later, which contains the fix for this vulnerability.

Other vulnerabilities in Plate

CVE-2026-65842High
Plate prior to 53.3.2 has a vulnerability in @platejs/docx-io that fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side environment. The converter can make requests to internal network resources and include the fetched image bytes in the generated DOCX, allowing server-side request forgery with response disclosure.

Original NVD description (English source)

Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as a javascript: iframe source that the registry MediaEmbedElement renders directly as an iframe src when a victim opens the document. This issue is fixed in version 53.1.4.