Description
Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the javascript: scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content.
Recommendation
Update the @udecode/plate-link package to the latest compatible version. Followings are version details:
- Affected version(s): < 20.0.0
- Patched version(s): 20.0.0
References
Could your website be exposed too?
SmartScanner can check your website for @udecode/plate-link does not sanitize URLs to prevent use of the `javascript:` scheme and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - CVE-2026-55661
- Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS - CVE-2026-62324
- Strapi does not verify the access or ID tokens issued during the OAuth flow - CVE-2023-22893
You might also like:
See something that needs correcting? Let us knowUpdated November 10, 2023