CVE-2026-65842
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Plate prior to 53.3.2 has a vulnerability in @platejs/docx-io that fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side environment. The converter can make requests to internal network resources and include the fetched image bytes in the generated DOCX, allowing server-side request forgery with response disclosure.
Risk Assessment
An attacker could access internal network resources and read their responses, potentially leading to disclosure of confidential information.
Recommendation
Update Plate to version 53.3.2 or later. Restrict access to internal network resources for conversion processes.
Other vulnerabilities in Plate
See all- CVE-2026-88976Medium
A vulnerability in Plate rich-text editor prior to 53.3.11 (and in discontinued 54.0.0-beta builds) affects HTML deserialization APIs that parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML, certain HTML attributes can trigger browser behavior before conversion to editor nodes, possibly allowing attacker-controlled script execution in the application's origin when another user loads the deserialized content. Fixed in version 53.3.11.
- CVE-2026-55596High
A vulnerability in the Plate rich-text editor (versions 53.0.0 to 53.1.4) allows JavaScript injection via embedded media. An attacker can craft a document that, when opened by a victim, renders an iframe with JavaScript code instead of a safe video source.
Original NVD description (English source)
Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the fetched image bytes in the generated DOCX, allowing server-side request forgery with response disclosure. Applications can also incur resource consumption from attacker-selected remote responses. This issue is fixed in version 53.3.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS