{"cve":"CVE-2023-34245","nvd":{"published":"2023-06-09T18:15:09.813","modified":"2026-06-17T06:03:12.770","status":"Modified","description":"@udecode/plate-link is the link handler for the udecode/plate rich-text editor plugin system for Slate & React. Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the `javascript:` scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content. `@udecode/plate-link` 20.0.0 resolves this issue by introducing an `allowedSchemes` option to the link plugin, defaulting to `['http', 'https', 'mailto', 'tel']`. URLs using a scheme that isn't in this list will not be rendered to the DOM. Users are advised to upgrade. Users unable to upgrade are advised to override the `LinkElement` and `PlateFloatingLink` components with implementations that explicitly check the URL scheme before rendering any anchor elements.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://github.com/udecode/plate/commit/93dd5712854660874900ae12e4d8e6ff28089eb7","https://github.com/udecode/plate/security/advisories/GHSA-4882-hxpr-hrvm","https://github.com/udecode/plate/commit/93dd5712854660874900ae12e4d8e6ff28089eb7","https://github.com/udecode/plate/security/advisories/GHSA-4882-hxpr-hrvm"],"products":["udecode:plate"],"source":"nvd","synced_at":"2026-10-19T21:38:24.161619714+00:00"},"epss":{"cve":"CVE-2023-34245","score":0.00445,"percentile":0.38716,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-4882-hxpr-hrvm","url":"https://osv.dev/vulnerability/GHSA-4882-hxpr-hrvm","summary":"@udecode/plate-link does not sanitize URLs to prevent use of the `javascript:` scheme","modified":"2026-09-10T03:50:01.851950637Z","packages":[{"ecosystem":"npm","name":"@udecode/plate-link","purl":"pkg:npm/%40udecode/plate-link","ranges":["<20.0.0"],"fixed":["20.0.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}