CVE-2023-34245

2023-06-0918:15:09

CWE-79

[email protected]

web.nvd.nist.gov

udecode

plate

link handler

rich-text editor

slate

react

cve-2023-34245

security

vulnerability

upgrade

javascript urls

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

0.001 Low

EPSS

Percentile

30.6%

JSON

@udecode/plate-link is the link handler for the udecode/plate rich-text editor plugin system for Slate & React. Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the javascript: scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content. @udecode/plate-link 20.0.0 resolves this issue by introducing an allowedSchemes option to the link plugin, defaulting to ['http', 'https', 'mailto', 'tel']. URLs using a scheme that isn’t in this list will not be rendered to the DOM. Users are advised to upgrade. Users unable to upgrade are advised to override the LinkElement and PlateFloatingLink components with implementations that explicitly check the URL scheme before rendering any anchor elements.

Affected configurations

Vulners

NVD

Node

udecodeplateRange<20.0.0

VendorProductVersionCPE
udecodeplate*cpe:2.3:a:udecode:plate:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
udecode	plate	*	cpe:2.3:a:udecode:plate::::::::

CNA Affected

[
  {
    "vendor": "udecode",
    "product": "plate",
    "versions": [
      {
        "version": "< 20.0.0",
        "status": "affected"
      }
    ]
  }
]