@udecode/plate-link does not sanitize URLs to prevent use of the `javascript:` scheme

Description

Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the javascript: scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content.

Recommendation

Update the @udecode/plate-link package to the latest compatible version. Followings are version details:

• Affected version(s): < 20.0.0
• Patched version(s): 20.0.0

References

• GHSA-4882-hxpr-hrvm
• CVE-2023-34245
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661
• TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - CVE-2026-55661
• Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS - CVE-2026-62324
• Strapi does not verify the access or ID tokens issued during the OAuth flow - CVE-2023-22893

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

Secure Coding 101: How to Use Random Function

Tags:

npm

@udecode/plate-link