Plate allows arbitrary DOM attributes in element.attributes and leaf.attributes

Description

One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the attributes property. These attributes are passed to the node component using the nodeProps prop.

Note: The attributes prop that is typically rendered alongside nodeProps is unrelated.

Recommendation

Update the @udecode/plate-core package to the latest compatible version. Followings are version details:

• Affected version(s): **< 21.5.1

  >= 22.0.0, < 36.5.9

  >= 37.0.0, < 38.0.6**

• Patched version(s): **21.5.1

  36.5.9

  38.0.6**

References

• GHSA-73rg-f94j-xvhx
• www.npmjs.com
• yarnpkg.com
• CVE-2024-47061
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818
• happy-dom allows for server side code to be executed by a <script> tag - CVE-2024-51757
• Plate media plugins has a XSS in media embed element when using custom URL parsers - CVE-2024-40631
• DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS - CVE-2024-47068

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@udecode/plate-core