EUVD-2026-80782Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Remote attacker supplies HTML with no privileges (PR:N); victim must load content (UI:R); script escapes library into consuming app origin (S:C); typical XSS Low C/I, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs, certain HTML attributes can trigger browser behavior before the HTML is converted into editor nodes. This can allow attacker-controlled script to execute in the consuming application's origin when another user loads the deserialized content. This issue is fixed in version 53.3.11.
AnalysisAI
Cross-site scripting in udecode Plate's core HTML deserialization APIs allows attacker-controlled script to execute in a consuming application's origin when untrusted or cross-user HTML is deserialized and then loaded by another user; affected builds are all versions prior to 53.3.11 plus the discontinued 54.0.0-beta.0 and 54.0.0-beta.1 prereleases. The pre-fix code parsed supplied HTML strings in the active document, so certain attributes triggered browser behavior before the markup was converted into editor nodes; the assessed vector (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects network-delivered input needing no authentication (PR:N) but requiring victim interaction (UI:R) and a scope change, and exploitation is only realistic where the consuming application itself wires attacker-influenced HTML into these APIs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the consuming application pass untrusted or cross-user HTML strings into Plate core's HTML deserialization APIs, and that a second user subsequently load/render that deserialized content (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity client-side XSS (CWE-79) in the udecode Plate rich-text editor's HTML deserialization APIs, well-calibrated at CVSS 6.1. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 53.3.11 - upgrade @platejs/core (and the Plate package) to 53.3.11 or later and do not deploy the discontinued 54.0.0-beta.0 or 54.0.0-beta.1 builds; see the advisory at https://github.com/udecode/plate/security/advisories/GHSA-qrfj-mgw8-j9c6, the fix PR at https://github.com/udecode/plate/pull/5117, the commit at https://github.com/udecode/plate/commit/d02afe45d5ec3a9fb95e0745bc5820ff18a3c12b, and the release tag at https://github.com/udecode/plate/releases/tag/v53.3.11. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-202
react-native-keys version 0.7.11 contains a sensitive information disclosure vulnerability where encryption ciphers and
HTML injection in Preact and React through unsafe JSON deserialization allows remote attackers to inject arbitrary scrip
Reflected XSS in Repostat's RepoCard React component prior to version 1.0.1 allows attackers to execute arbitrary JavaSc
OS command injection in create-react-app's react-dev-utils component enables remote code execution on macOS developer wo
Uncontrolled resource consumption in React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react
Refine's @refinedev/inferencer package through version 7.0.0 interpolates API field names straight into generated JSX so
Simple Membership (WordPress plugin) versions up to 4.7.0 contains a security vulnerability (CVSS 6.5).
React-Router versions up to 6.30.1 is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).
Wekan is an open source kanban tool built with Meteor. [CVSS 6.5 MEDIUM]
React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. [CVSS 6.5 MEDIUM]
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today