@udecode/plate (>=36.0.0, <=36.0.9), @udecode/plate-serializer-docx (>=36.0.0, <=36.0.9) potentially affected by CVE-2024-40631 via @udecode/plate-media (36.0.0)

@udecode/plate-media NPM version 36.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @udecode/plate-media and may be impacted: - @udecode/plate =36.0.0, =36.0.0, =36.0.9 Source cves: CVE-2024-40631 Source advisory: OSV:GHSA-H3PQ-667X-R789...

CVE-2024-40631 Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media

Plate media is an open source, rich-text editor for React. Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or vbscript: URLs to be embedded. Editors that do not use urlParsers and consume...

CVE-2024-40631 Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media

Plate media is an open source, rich-text editor for React. Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or vbscript: URLs to be embedded. Editors that do not use urlParsers and consume...