Plate media plugins has a XSS in media embed element when using custom URL parsers

Description

Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or vbscript: URLs to be embedded. Editors that do not use urlParsers and instead consume the url property directly may also be vulnerable if the URL is not sanitised.

Recommendation

Update the @udecode/plate-media package to the latest compatible version. Followings are version details:

• Affected version(s): < 36.0.10
• Patched version(s): 36.0.10

References

• GHSA-h3pq-667x-r789
• stackoverflow.com
• CVE-2024-40631
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - CVE-2024-29881
• Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS - CVE-2024-43788
• Stored Cross-site Scripting (XSS) in excalidraw's web embed component - CVE-2024-32472
• NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins - CVE-2026-40346

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@udecode/plate-media