CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2026-88976
Medium (6.1). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in @platejs/core 53.3.11.
Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs, certain HTML attributes can trigger browser behavior before the HTML is converted into editor nodes. This can allow attacker-controlled script to execute in the consuming application's origin when another user loads the deserialized content. This issue is fixed in version 53.3.11.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qrfj-mgw8-j9c6 | npm | @platejs/core | <53.3.11 | 53.3.11 |
| GHSA-qrfj-mgw8-j9c6 | npm | @platejs/core | >=54.0.0-beta.0 <=54.0.0-beta.1 | no fix published |