Description
HTML strings passed to Plate’s core deserialization APIs were parsed in the active document. Certain HTML attributes could therefore trigger browser behavior during parsing, before the content was converted into editor nodes.
Applications that deserialize HTML from untrusted or cross-user sources may be affected.
Recommendation
Update the @platejs/core package to the latest compatible version. Followings are version details:
Affected version(s): **>= 54.0.0-beta.0, <= 54.0.0-beta.1 < 53.3.11** - Patched version(s): 53.3.11
References
Could your website be exposed too?
SmartScanner can check your website for @platejs/core HTML deserialization can trigger browser behavior during parsing and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing - CVE-2026-118244
- UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()` - CVE-2026-48125
- markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled - CVE-2026-111766
- seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization - CVE-2026-59940
You might also like:
See something that needs correcting? Let us knowUpdated September 17, 2026