CVE-2026-55596
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability in the Plate rich-text editor (versions 53.0.0 to 53.1.4) allows JavaScript injection via embedded media. An attacker can craft a document that, when opened by a victim, renders an iframe with JavaScript code instead of a safe video source.
Risk Assessment
The risk involves arbitrary JavaScript execution in the victim's browser context, potentially leading to data theft, session hijacking, or other XSS attacks.
Recommendation
Immediately update the Plate library to version 53.1.4 or later, which contains the fix for this vulnerability.
Other vulnerabilities in Plate
See all- CVE-2026-88976Medium
A vulnerability in Plate rich-text editor prior to 53.3.11 (and in discontinued 54.0.0-beta builds) affects HTML deserialization APIs that parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML, certain HTML attributes can trigger browser behavior before conversion to editor nodes, possibly allowing attacker-controlled script execution in the application's origin when another user loads the deserialized content. Fixed in version 53.3.11.
- CVE-2026-65842High
Plate prior to 53.3.2 has a vulnerability in @platejs/docx-io that fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side environment. The converter can make requests to internal network resources and include the fetched image bytes in the generated DOCX, allowing server-side request forgery with response disclosure.
Original NVD description (English source)
Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as a javascript: iframe source that the registry MediaEmbedElement renders directly as an iframe src when a victim opens the document. This issue is fixed in version 53.1.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS