Vulnerability	Vulnerable Version
M Cross-site Scripting (XSS) @udecode/plate-core is a The core of Plate – a plugin system for slate Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the `attributes` property, which holds custom attributes on any element in the DOM, and passes them to the node component in `nodeProps`. An attacker can execute scripts or expose IP addresses and whether or not the user has opened a malicious document by injecting into DOM attributes like `href` (on links) or `src` (on iframes). Components that use `nodeProps` on an `<a>` or `<iframe>` element but override them after processing user input are not affected. Attack vectors for this exploit include convincing a user to open a malicious slate document on the vulnerable server, to open a document containing a malicious slate fragment, or to execute a slate operation on a collaborative document. Note: This behavior is only a vulnerability if the application's intention is to restrict the embedding of external content from arbitrary URLs. Otherwise it is behaving as expected. How to fix Cross-site Scripting (XSS)? Upgrade `@udecode/plate-core` to version 21.5.1, 36.5.9, 38.0.6 or higher.	<21.5.1>=22.0.0 <36.5.9>=37.0.0 <38.0.6

Cross-site Scripting (XSS)

@udecode/plate-core is a The core of Plate – a plugin system for slate

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the attributes property, which holds custom attributes on any element in the DOM, and passes them to the node component in nodeProps. An attacker can execute scripts or expose IP addresses and whether or not the user has opened a malicious document by injecting into DOM attributes like href (on links) or src (on iframes). Components that use nodeProps on an <a> or <iframe> element but override them after processing user input are not affected.

Attack vectors for this exploit include convincing a user to open a malicious slate document on the vulnerable server, to open a document containing a malicious slate fragment, or to execute a slate operation on a collaborative document.

Note: This behavior is only a vulnerability if the application's intention is to restrict the embedding of external content from arbitrary URLs. Otherwise it is behaving as expected.

How to fix Cross-site Scripting (XSS)?

Upgrade @udecode/plate-core to version 21.5.1, 36.5.9, 38.0.6 or higher.

<21.5.1>=22.0.0 <36.5.9>=37.0.0 <38.0.6

Go back to all versions of this package