Homepage

@platejs/docx-io@52.2.0

DOCX import/export for Plate - file-based document conversion

  • latest version

    53.3.2

  • latest non vulnerable version

    54.0.0-beta.0

  • first published

    7 months ago

  • latest version published

    1 months ago

  • licenses detected

  • View docx-io package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @platejs/docx-io package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Server-side Request Forgery (SSRF)

    @platejs/docx-io is a DOCX import/export for Plate - file-based document conversion

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the buildImage and buildParagraph functions in render-document-file.ts and xml-builder.ts, which unconditionally fetch remote image URLs embedded in HTML content during DOCX export. An attacker who can supply HTML with arbitrary <img src="..."> URLs can cause the server to issue outbound HTTP requests to attacker-controlled or internal network endpoints, enabling SSRF and potentially exposing internal services or sensitive data. The fix introduces an allowRemoteImages option that defaults to false, blocking all remote URL fetches unless explicitly opted in.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade @platejs/docx-io to version 53.3.2 or higher.

    <53.3.2
    Go back to all versions of this package