CVE-2026-55596

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55596
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55596.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55596
Aliases
Published
2026-07-08T20:27:58Z
Modified
2026-10-21T02:58:38Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript
Details

Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as a javascript: iframe source that the registry MediaEmbedElement renders directly as an iframe src when a victim opens the document. This issue is fixed in version 53.1.4.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55596.json"
}
References

Affected packages

Git / github.com/udecode/plate

Affected ranges

Type
GIT
Repo
https://github.com/udecode/plate
Events
Introduced
7b9b204e1e38a20b1f8bec5a900d67c64afbc525
Fixed
c5b8e60148c5fbe4c8047cd5cf049127c6091314
Fixed
6214914ca811adf22d0ad503154494216eed68ba
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "53.0.0"
                },
                {
                    "fixed":  "53.1.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "6214914ca811adf22d0ad503154494216eed68ba"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v53.1.4",
            "range":  [
                {
                    "fixed":  "c5b8e60148c5fbe4c8047cd5cf049127c6091314"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

@platejs/ai@53.*
@platejs/ai@53.0.0
@platejs/ai@53.0.3
@platejs/ai@53.0.4
@platejs/ai@53.0.7
@platejs/ai@53.0.9
@platejs/ai@53.1.1
@platejs/autoformat@53.*
@platejs/autoformat@53.0.0
@platejs/basic-nodes@53.*
@platejs/basic-nodes@53.0.0
@platejs/basic-styles@53.*
@platejs/basic-styles@53.0.0
@platejs/callout@53.*
@platejs/callout@53.0.0
@platejs/caption@53.*
@platejs/caption@53.0.0
@platejs/code-block@53.*
@platejs/code-block@53.0.0
@platejs/code-drawing@53.*
@platejs/code-drawing@53.0.0
@platejs/combobox@53.*
@platejs/combobox@53.0.0
@platejs/comment@53.*
@platejs/comment@53.0.0
@platejs/core@53.*
@platejs/core@53.0.0
@platejs/core@53.0.5
@platejs/core@53.0.6
@platejs/core@53.0.7
@platejs/core@53.1.2
@platejs/csv@53.*
@platejs/csv@53.0.0
@platejs/csv@53.0.7
@platejs/csv@53.0.9
@platejs/cursor@53.*
@platejs/cursor@53.0.0
@platejs/date@53.*
@platejs/date@53.0.0
@platejs/diff@53.*
@platejs/diff@53.0.0
@platejs/dnd@53.*
@platejs/dnd@53.0.0
@platejs/dnd@53.1.0
@platejs/docx-io@53.*
@platejs/docx-io@53.0.0
@platejs/docx-io@53.0.8
@platejs/docx-io@53.1.0
@platejs/docx@53.*
@platejs/docx@53.0.0
@platejs/emoji@53.*
@platejs/emoji@53.0.0
@platejs/excalidraw@53.*
@platejs/excalidraw@53.0.0
@platejs/find-replace@53.*
@platejs/find-replace@53.0.0
@platejs/floating@53.*
@platejs/floating@53.0.0
@platejs/footnote@53.*
@platejs/footnote@53.0.0
@platejs/indent@53.*
@platejs/indent@53.0.0
@platejs/juice@53.*
@platejs/juice@53.0.0
@platejs/layout@53.*
@platejs/layout@53.0.0
@platejs/link@53.*
@platejs/link@53.0.0
@platejs/link@53.0.3
@platejs/list-classic@53.*
@platejs/list-classic@53.0.0
@platejs/list@53.*
@platejs/list@53.0.0
@platejs/list@53.0.2
@platejs/list@53.1.3
@platejs/markdown@53.*
@platejs/markdown@53.0.0
@platejs/markdown@53.0.4
@platejs/markdown@53.1.1
@platejs/math@53.*
@platejs/math@53.0.0
@platejs/media@53.*
@platejs/media@53.0.0
@platejs/media@53.0.1
@platejs/mention@53.*
@platejs/mention@53.0.0
@platejs/playwright@53.*
@platejs/playwright@53.0.0
@platejs/resizable@53.*
@platejs/resizable@53.0.0
@platejs/selection@53.*
@platejs/selection@53.0.0
@platejs/slash-command@53.*
@platejs/slash-command@53.0.0
@platejs/slate@53.*
@platejs/slate@53.0.0
@platejs/slate@53.0.5
@platejs/slate@53.0.7
@platejs/suggestion@53.*
@platejs/suggestion@53.0.0
@platejs/suggestion@53.0.3
@platejs/tabbable@53.*
@platejs/tabbable@53.0.0
@platejs/table@53.*
@platejs/table@53.0.0
@platejs/table@53.0.7
@platejs/table@53.0.9
@platejs/tag@53.*
@platejs/tag@53.0.0
@platejs/test-utils@53.*
@platejs/test-utils@53.0.0
@platejs/test-utils@53.0.5
@platejs/test-utils@53.0.7
@platejs/toc@53.*
@platejs/toc@53.0.0
@platejs/toggle@53.*
@platejs/toggle@53.0.0
@platejs/utils@53.*
@platejs/utils@53.0.0
@platejs/utils@53.0.3
@platejs/utils@53.0.5
@platejs/utils@53.0.6
@platejs/utils@53.0.7
@platejs/utils@53.1.2
@platejs/yjs@53.*
@platejs/yjs@53.0.0
platejs@53.*
platejs@53.0.0
platejs@53.0.3
platejs@53.0.5
platejs@53.0.6
platejs@53.0.7
platejs@53.1.2
v53.*
v53.0.5
v53.0.6
v53.0.7
v53.0.8
v53.0.9
v53.1.0
v53.1.1
v53.1.2
v53.1.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55596.json"