6 matches found
@udecode/plate (>=36.0.0, <=36.0.9), @udecode/plate-serializer-docx (>=36.0.0, <=36.0.9) potentially affected by CVE-2024-40631 via @udecode/plate-media (36.0.0)
@udecode/plate-media NPM version 36.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @udecode/plate-media and may be impacted: - @udecode/plate =36.0.0, =36.0.0, =36.0.9 Source cves: CVE-2024-40631 Source advisory: GHSA-H3PQ-667X-R789...
@udecode/plate (>=36.0.0, <=36.0.9), @udecode/plate-serializer-docx (>=36.0.0, <=36.0.9) potentially affected by CVE-2024-40631 via @udecode/plate-media (36.0.0)
@udecode/plate-media NPM version 36.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @udecode/plate-media and may be impacted: - @udecode/plate =36.0.0, =36.0.0, =36.0.9 Source cves: CVE-2024-40631 Source advisory: OSV:GHSA-H3PQ-667X-R789...
CVE-2024-40631 Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media
Plate media is an open source, rich-text editor for React. Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or vbscript: URLs to be embedded. Editors that do not use urlParsers and consume...
CVE-2024-40631 Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media
Plate media is an open source, rich-text editor for React. Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or vbscript: URLs to be embedded. Editors that do not use urlParsers and consume...
@archbee/utils (>=1.0.103, <=1.1.41), @boatproject/editor (>=5.0.0, <=5.0.1) +69 more potentially affected by CVE-2024-40631 via @udecode/plate-media (>=16.0.0, <=36.0.0)
@udecode/plate-media NPM version =16.0.0, =1.0.103, =5.0.0, =0.0.3, =0.10.0, =0.0.0-20240315110821, =3.4.0, =5.1.0, =0.0.1, =0.0.2, =12.0.0-beta-15, =0.28.0, =0.0.3, =0.6.9, =0.0.0-20230511135047, =0.0.0-20230511135047, =0.1.2 and more Source cves: CVE-2024-40631 Source advisory: MEND:CVE-2024-40...
CVE-2024-40631
Plate media is an open source, rich-text editor for React. Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or vbscript: URLs to be embedded. Editors that do not use urlParsers and consume...