TI-2026-46915 Aliases CVE-2026-65842 GHSA-4q39-2jhr-7qx8

Plate: SSRF with response disclosure in DOCX image embedding

MEDIUM 42CWE-918Published 2026-08-20 · Updated 2026-08-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the fetched image bytes in the generated DOCX, allowing server-side request forgery with response disclosure. Applications can also incur resource consumption from attacker-selected remote responses. This issue is fixed in version 53.3.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00524 44th percentileScored 2026-11-07

Fix Fixed plate (udecode): 53.3.2@platejs/docx-io (npm): 53.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
udecode	plate	before 53.3.2	53.3.2	Patch available	CNA
—	@platejs/docx-io (npm)	before 53.3.2	53.3.2	Patch available	GHSA-4q39-2jhr-7qx8

plate Vendorudecode Affected before 53.3.2 Fixed in 53.3.2 Patch available CNA
@platejs/docx-io (npm) Vendor— Affected before 53.3.2 Fixed in 53.3.2 Patch available GHSA-4q39-2jhr-7qx8

Remediation

Fix · CNA plate (udecode) Fixed in 53.3.2
Fix · GHSA-4q39-2jhr-7qx8 @platejs/docx-io (npm) Fixed in 53.3.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-65842
2026-10-03 Alias added: GHSA-4q39-2jhr-7qx8

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-65842

Other 5

TI-2026-40133 Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript CVSS 3.1HIGH 8.7
TI-2023-17081 Cross site scripting (XSS) in @udecode/plate-link CVSS 3.1HIGH 8.1
TI-2024-31443 Arbitrary DOM attributes in element.attributes and leaf.attributes in Platejs CVSS 3.1HIGH 8.3
TI-2024-27043 Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media CVSS 3.1HIGH 8.1
TI-2026-60308 @platejs/core HTML deserialization can trigger browser behavior during parsing CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences