Description
One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the attributes property. These attributes are passed to the node component using the nodeProps prop.
Note: The attributes prop that is typically rendered alongside nodeProps is unrelated.
Recommendation
Update the @udecode/plate-core package to the latest compatible version. Followings are version details:
Affected version(s): **< 21.5.1 >= 22.0.0, < 36.5.9 >= 37.0.0, < 38.0.6** Patched version(s): **21.5.1 36.5.9 38.0.6**
References
Could your website be exposed too?
SmartScanner can check your website for Plate allows arbitrary DOM attributes in element.attributes and leaf.attributes and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818
- happy-dom allows for server side code to be executed by a <script> tag - CVE-2024-51757
- Plate media plugins has a XSS in media embed element when using custom URL parsers - CVE-2024-40631
- DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS - CVE-2024-47068
You might also like:
See something that needs correcting? Let us knowUpdated September 20, 2024