GHSA-4Q39-2JHR-7QX8 Plate: SSRF with response disclosure in DOCX image embedding

Summary @platejs/docx-io can fetch remote image URLs while converting HTML to DOCX. When an application converts attacker-controlled HTML in a server-side or privileged environment, this can cause the application environment to make unintended outbound requests and include fetched image data in t...

Plate: SSRF with response disclosure in DOCX image embedding

Summary @platejs/docx-io can fetch remote image URLs while converting HTML to DOCX. When an application converts attacker-controlled HTML in a server-side or privileged environment, this can cause the application environment to make unintended outbound requests and include fetched image data in t...

@docyrus/ui-pro-ai-assistant (>=0.8.4, <=0.12.9) potentially affected by CVE-2026-65842 via @platejs/docx-io (53.1.0)

@platejs/docx-io NPM version 53.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @platejs/docx-io and may be impacted: - @docyrus/ui-pro-ai-assistant =0.8.4, =0.12.9 Source cves: CVE-2026-65842 Source advisory: GHSA-4Q39-2JHR-7QX8...

@docyrus/ui-pro-ai-assistant (>=0.8.4, <=0.12.9) potentially affected by CVE-2026-65842 via @platejs/docx-io (53.1.0)

@platejs/docx-io NPM version 53.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @platejs/docx-io and may be impacted: - @docyrus/ui-pro-ai-assistant =0.8.4, =0.12.9 Source cves: CVE-2026-65842 Source advisory: OSV:GHSA-4Q39-2JHR-7QX8...

Server-side Request Forgery (SSRF)

Overview @platejs/docx-io is a DOCX import/export for Plate - file-based document conversion Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the buildImage and buildParagraph functions in render-document-file.ts and xml-builder.ts, which unconditionally...

@docyrus/ui-pro-ai-assistant (>=0.8.4, <=0.12.9) potentially affected by CVE-2026-65842 via @platejs/docx-io (53.1.0)

@platejs/docx-io NPM version 53.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @platejs/docx-io and may be impacted: - @docyrus/ui-pro-ai-assistant =0.8.4, =0.12.9 Source cves: CVE-2026-65842 Source advisory: SNYK:JS-PLATEJSDOCXIO-19233388...

CVE-2026-65842

Plate (a rich-text editor with AI and shadcn/ui) is affected by a server-side request forgery (SSRF) with response disclosure in the @platejs/docx-io package prior to version 53.3.2 . The htmlToDocxBlob function fetches remote image URLs from attacker-controlled HTML when used in a server-side or...

@docyrus/ui-pro-ai-assistant (>=0.0.1, <=0.12.9), @oyat/editor (>=1.7.9, <=1.8.6) potentially affected by CVE-2026-65842 via @platejs/docx-io (>=52.2.0, <=53.1.0)

@platejs/docx-io NPM version =52.2.0, =0.0.1, =1.7.9, =1.8.6 Source cves: CVE-2026-65842 Source advisory: MEND:CVE-2026-65842...

CVE-2026-65842: Server-Side Request Forgery (SSRF)

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the...

PT-2026-79065

Name of the Vulnerable Software and Affected Versions Plate versions prior to 53.3.2 Description When converting attacker-controlled HTML through the htmlToDocxBlob function in a server-side or privileged environment, the @platejs/docx-io module fetches remote image URLs. This behavior allows for...