CVE-2024-47061 Arbitrary DOM attributes in element.attributes and leaf.attributes in Platejs

Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the attributes property. These attributes are passed to the...

CVE-2024-47061 Arbitrary DOM attributes in element.attributes and leaf.attributes in Platejs

Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the attributes property. These attributes are passed to the...

CVE-2024-47061 Arbitrary DOM attributes in element.attributes and leaf.attributes in Platejs

Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the attributes property. These attributes are passed to the...

CVE-2024-47061

The CVE-2024-47061 issue affects Plate editors using @udecode/plate-core, where arbitrary DOM attributes can be injected via nodeProps (often from the attributes property), enabling cross-site scripting (XSS) and potential information exposure (e.g., user IPs and whether a malicious document is o...

@teable/sdk (>=1.5.0, <=1.8.0), @udecode/plate (>=37.0.0, <=38.0.5) +3 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=37.0.0, <=38.0.4)

@udecode/plate-core NPM version =37.0.0, =1.5.0, =37.0.0, =37.0.0, =37.0.0, =0.2.62, =0.2.83 Source cves: CVE-2024-47061 Source advisory: OSV:GHSA-73RG-F94J-XVHX...

@chirper/mythiq (>=0.0.3, <=0.0.20), @cloudcommerce/storefront (>=0.10.0, <=0.11.0) +106 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=21.0.0, <=21.5.0)

@udecode/plate-core NPM version =21.0.0, =0.0.3, =0.10.0, =0.0.0-20240315110821, =12.0.0-beta.319, =0.28.0, =0.0.3, =0.6.9, =0.0.0-20230511135047, =0.0.0-20230511135047, =1.0.0, =0.0.4, =0.0.85, =0.0.89, =0.0.93 and more Source cves: CVE-2024-47061 Source advisory: OSV:GHSA-73RG-F94J-XVHX...

@baseline-ui/app (0.22.1), @baseline-ui/core (0.22.1) +109 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=22.0.0, <=36.3.9)

@udecode/plate-core NPM version =22.0.0, =3.11.0, =0.1.0, =5.1.1, =0.0.1, =0.0.1, =0.0.2, =12.0.0-beta.405, =0.34.0, =0.9.7, =0.0.23, =0.2.8, =0.3.45 and more Source cves: CVE-2024-47061 Source advisory: OSV:GHSA-73RG-F94J-XVHX...

CVE-2024-47061: Improper Neutralization of Input During Web Page Generation

Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the attributes property. These attributes are passed to the...