Homepage
About Snyk

@udecode/plate-core@36.0.6 vulnerabilities

The core of Plate – a plugin system for slate

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the @udecode/plate-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting (XSS)

@udecode/plate-core is a The core of Plate – a plugin system for slate

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the attributes property, which holds custom attributes on any element in the DOM, and passes them to the node component in nodeProps. An attacker can execute scripts or expose IP addresses and whether or not the user has opened a malicious document by injecting into DOM attributes like href (on links) or src (on iframes). Components that use nodeProps on an <a> or <iframe> element but override them after processing user input are not affected.

Attack vectors for this exploit include convincing a user to open a malicious slate document on the vulnerable server, to open a document containing a malicious slate fragment, or to execute a slate operation on a collaborative document.

Note: This behavior is only a vulnerability if the application's intention is to restrict the embedding of external content from arbitrary URLs. Otherwise it is behaving as expected.

How to fix Cross-site Scripting (XSS)?

Upgrade @udecode/plate-core to version 21.5.1, 36.5.9, 38.0.6 or higher.

<21.5.1 >=22.0.0 <36.5.9 >=37.0.0 <38.0.6
Go back to all versions of this package