EUVD-2026-63471
GHSA-4q39-2jhr-7qx8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Network-reachable SSRF requiring no authentication or interaction; high confidentiality via embedded response disclosure; scope unchanged as impact is realized through the returned DOCX rather than direct secondary-system compromise.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the fetched image bytes in the generated DOCX, allowing server-side request forgery with response disclosure. Applications can also incur resource consumption from attacker-selected remote responses. This issue is fixed in version 53.3.2.
AnalysisAI
Server-side request forgery in @platejs/docx-io prior to 53.3.2 allows network-accessible attackers to exfiltrate internal network content by supplying crafted HTML to the htmlToDocxBlob function. When attacker-controlled HTML containing img tags referencing internal URLs is processed server-side, the converter fetches those resources and embeds the response bytes into the generated DOCX, creating a response-disclosure channel to internal network infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: first, the target application must accept HTML input from an untrusted source (e.g., user-submitted content, API-provided HTML, uploaded documents, or web-scraped material); second, that HTML must be passed to htmlToDocxBlob in a server-side or privileged environment where the server process has network access to internal resources. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) accurately reflects the network-reachable, low-complexity exploitation path and high confidentiality impact, but practical risk is strongly conditioned on application design. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade @platejs/docx-io to version 53.3.2 or later, which skips remote image URLs by default. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems and applications using @platejs/docx-io and document which ones process untrusted user input server-side. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today