EUVD-2024-2354

Malicious code in bioql PyPI...

CVE-2024-40631

Plate media is an open source, rich-text editor for React. Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or vbscript: URLs to be embedded. Editors that do not use urlParsers and consume...

@archbee/utils (>=1.0.103 <=1.1.41), @boatproject/editor (>=5.0.0 <=5.0.1) +69 more potentially affected by CVE-2024-40631 via @udecode/plate-media (>=16.0.0 <=36.0.0)

@udecode/plate-media NPM version =16.0.0, =1.0.103, =5.0.0, =0.0.3, =0.10.0, =0.0.0, =3.4.0, =1.0.99, =5.1.0, =0.0.1, =0.0.2, =12.0.0-beta-15, =0.28.0, =0.0.3, =0.6.9, =0.0.0-20230511135047, =0.1.2 and more Source cves: CVE-2024-40631 Source advisory: OSV:GHSA-H3PQ-667X-R789...

CVE-2024-40631 Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media

Plate media is an open source, rich-text editor for React. Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or vbscript: URLs to be embedded. Editors that do not use urlParsers and consume...

CVE-2024-40631 Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media

Plate media is an open source, rich-text editor for React. Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or vbscript: URLs to be embedded. Editors that do not use urlParsers and consume...

CVE-2024-40631

The CVE-2024-40631 vulnerability affects Plate’s media embedding in editors using MediaEmbedElement with custom urlParsers in @udecode/plate-media. Affected code paths allow un-sanitised URLs (javascript:, data:, vbscript:) to reach iframe sources via the embed property from useMediaState, or the...

CVE-2024-40631 Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media

Plate media is an open source, rich-text editor for React. Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or vbscript: URLs to be embedded. Editors that do not use urlParsers and consume...

PT-2024-28953 · Npm · @Udecode/Plate-Media

Name of the Vulnerable Software and Affected Versions: @udecode/plate-media versions prior to 36.0.10 Description: The issue affects editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook, potentially allowing XSS if a custom parser permits javascript:, data: or...