Description
The media embed renderer trusts serialized provider or sourceUrl metadata and skips the URL protocol validation that normally blocks unsafe media embed URLs. A crafted Plate document can set a known video provider while keeping url as a javascript: iframe source.
Recommendation
Update the @platejs/media package to the latest compatible version. Followings are version details:
- Affected version(s): >= 53.0.0, < 53.1.4
- Patched version(s): 53.1.4
References
Could your website be exposed too?
SmartScanner can check your website for Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover - @tinacms/app - CVE-2026-55660
- TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover - CVE-2026-55660
- Plate media plugins has a XSS in media embed element when using custom URL parsers - CVE-2024-40631
- LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader - CVE-2026-27795
You might also like:
See something that needs correcting? Let us knowUpdated August 25, 2026