CVE-2023-34245

@udecode/plate-link is the link handler for the udecode/plate rich-text editor plugin system for Slate & React. Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the javascript: scheme. As a result, links with JavaScript URLs can be inserted into th...

@baseline-ui/app (0.22.1), @baseline-ui/core (0.22.1) +111 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=22.0.0, <=36.3.9)

@udecode/plate-core NPM version =22.0.0, =3.11.0, =0.1.0, =5.1.1, =0.0.1, =0.0.1, =0.0.2, =12.0.0-beta.405, =0.34.0, =0.9.7, =0.0.23, =1.3.1 - @inditeai/nextjs 1.0.0 - @inditeai/react 1.0.0 and more Source cves: CVE-2024-47061 Source advisory: MEND:CVE-2024-47061...

@12joan/plate-tabbable (19.4.0), @antv/narrative-text-editor (>=0.1.1, <=0.2.20) +195 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=1.0.0, <=21.5.0)

@udecode/plate-core NPM version =1.0.0, =0.1.1, =1.0.103, =1.3.0, =2.19.0, =1.0.1, =0.1.49, =0.0.1, =0.0.7, =0.0.1, =0.0.1, =0.0.3, =0.0.20 and more Source cves: CVE-2024-47061 Source advisory: MEND:CVE-2024-47061...

CVE-2024-47061

Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the "attributes" property. These attributes are passed to the...

@ohos-ports/udecode-plate-serializer-md (37.0.0-beta.2), @teable/sdk (>=1.5.0, <=1.8.0) +4 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=37.0.0, <=38.0.4)

@udecode/plate-core NPM version =37.0.0, =1.5.0, =37.0.0, =37.0.0, =37.0.0, =0.2.62, =0.2.83 Source cves: CVE-2024-47061 Source advisory: MEND:CVE-2024-47061...

CVE-2024-47061 Arbitrary DOM attributes in element.attributes and leaf.attributes in Platejs

Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the attributes property. These attributes are passed to the...

CVE-2024-47061 Arbitrary DOM attributes in element.attributes and leaf.attributes in Platejs

Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the attributes property. These attributes are passed to the...

CVE-2024-47061

The CVE-2024-47061 issue affects Plate editors using @udecode/plate-core, where arbitrary DOM attributes can be injected via nodeProps (often from the attributes property), enabling cross-site scripting (XSS) and potential information exposure (e.g., user IPs and whether a malicious document is o...

@chirper/mythiq (>=0.0.3, <=0.0.20), @cloudcommerce/storefront (>=0.10.0, <=0.11.0) +106 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=21.0.0, <=21.5.0)

@udecode/plate-core NPM version =21.0.0, =0.0.3, =0.10.0, =0.0.0-20240315110821, =12.0.0-beta.319, =0.28.0, =0.0.3, =0.6.9, =0.0.0-20230511135047, =0.0.0-20230511135047, =1.0.0, =0.0.4, =0.0.85, =0.0.89, =0.0.93 and more Source cves: CVE-2024-47061 Source advisory: OSV:GHSA-73RG-F94J-XVHX...

@ohos-ports/udecode-plate-serializer-md (37.0.0-beta.2), @teable/sdk (>=1.5.0, <=1.8.0) +4 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=37.0.0, <=38.0.4)

@udecode/plate-core NPM version =37.0.0, =1.5.0, =37.0.0, =37.0.0, =37.0.0, =0.2.62, =0.2.83 Source cves: CVE-2024-47061 Source advisory: GHSA-73RG-F94J-XVHX...

@baseline-ui/app (0.22.1), @baseline-ui/core (0.22.1) +111 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=22.0.0, <=36.3.9)

@udecode/plate-core NPM version =22.0.0, =3.11.0, =0.1.0, =5.1.1, =0.0.1, =0.0.1, =0.0.2, =12.0.0-beta.405, =0.34.0, =0.9.7, =0.0.23, =1.3.1 - @inditeai/nextjs 1.0.0 - @inditeai/react 1.0.0 and more Source cves: CVE-2024-47061 Source advisory: OSV:GHSA-73RG-F94J-XVHX...

@ohos-ports/udecode-plate-serializer-md (37.0.0-beta.2), @teable/sdk (>=1.5.0, <=1.8.0) +4 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=37.0.0, <=38.0.4)

@udecode/plate-core NPM version =37.0.0, =1.5.0, =37.0.0, =37.0.0, =37.0.0, =0.2.62, =0.2.83 Source cves: CVE-2024-47061 Source advisory: OSV:GHSA-73RG-F94J-XVHX...

@chirper/mythiq (>=0.0.3, <=0.0.20), @cloudcommerce/storefront (>=0.10.0, <=0.11.0) +106 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=21.0.0, <=21.5.0)

@udecode/plate-core NPM version =21.0.0, =0.0.3, =0.10.0, =0.0.0-20240315110821, =12.0.0-beta.319, =0.28.0, =0.0.3, =0.6.9, =0.0.0-20230511135047, =0.0.0-20230511135047, =1.0.0, =0.0.4, =0.0.85, =0.0.89, =0.0.93 and more Source cves: CVE-2024-47061 Source advisory: GHSA-73RG-F94J-XVHX...

@baseline-ui/app (0.22.1), @baseline-ui/core (0.22.1) +111 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=22.0.0, <=36.3.9)

@udecode/plate-core NPM version =22.0.0, =3.11.0, =0.1.0, =5.1.1, =0.0.1, =0.0.1, =0.0.2, =12.0.0-beta.405, =0.34.0, =0.9.7, =0.0.23, =1.3.1 - @inditeai/nextjs 1.0.0 - @inditeai/react 1.0.0 and more Source cves: CVE-2024-47061 Source advisory: GHSA-73RG-F94J-XVHX...

CVE-2024-47061: Improper Neutralization of Input During Web Page Generation

Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the attributes property. These attributes are passed to the...

@udecode/plate (>=36.0.0, <=36.0.9), @udecode/plate-serializer-docx (>=36.0.0, <=36.0.9) potentially affected by CVE-2024-40631 via @udecode/plate-media (36.0.0)

@udecode/plate-media NPM version 36.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @udecode/plate-media and may be impacted: - @udecode/plate =36.0.0, =36.0.0, =36.0.9 Source cves: CVE-2024-40631 Source advisory: OSV:GHSA-H3PQ-667X-R789...

@udecode/plate (>=36.0.0, <=36.0.9), @udecode/plate-serializer-docx (>=36.0.0, <=36.0.9) potentially affected by CVE-2024-40631 via @udecode/plate-media (36.0.0)

@udecode/plate-media NPM version 36.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @udecode/plate-media and may be impacted: - @udecode/plate =36.0.0, =36.0.0, =36.0.9 Source cves: CVE-2024-40631 Source advisory: GHSA-H3PQ-667X-R789...

CVE-2024-40631 Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media

Plate media is an open source, rich-text editor for React. Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or vbscript: URLs to be embedded. Editors that do not use urlParsers and consume...

CVE-2024-40631

Plate media is an open source, rich-text editor for React. Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or vbscript: URLs to be embedded. Editors that do not use urlParsers and consume...

@archbee/utils (>=1.0.103, <=1.1.41), @boatproject/editor (>=5.0.0, <=5.0.1) +69 more potentially affected by CVE-2024-40631 via @udecode/plate-media (>=16.0.0, <=36.0.0)

@udecode/plate-media NPM version =16.0.0, =1.0.103, =5.0.0, =0.0.3, =0.10.0, =0.0.0-20240315110821, =3.4.0, =5.1.0, =0.0.1, =0.0.2, =12.0.0-beta-15, =0.28.0, =0.0.3, =0.6.9, =0.0.0-20230511135047, =0.0.0-20230511135047, =0.1.2 and more Source cves: CVE-2024-40631 Source advisory: MEND:CVE-2024-40...