@platejs/core@52.3.21

@platejs/core is a The core of Plate – a plugin system for slate

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the htmlStringToDOMNode and getEditorDOMFromHtmlString parsers in packages/core/src/lib/plugins/html/utils/htmlStringToDOMNode.ts and packages/core/src/static/deserialize/htmlStringToEditorDOM.ts. An attacker can execute script in the application's origin by supplying HTML that is later deserialized in another user's browser, where parsing occurs in the active document and browser-handled attributes can fire during innerHTML assignment. This affects applications that accept untrusted or cross-user HTML and then pass it into Plate's core string deserialization APIs, exposing users to browser-side script execution before the content is converted into editor nodes.

Workarounds

• Applications should sanitize untrusted HTML before rendering it; this prevents attacker-controlled markup from reaching Plate’s deserialization path and blocks browser behavior during parsing.

A fix was pushed into the master branch but not yet published.