{"uuid": "20e82656-df69-4731-ac96-b8a84b7d58b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55596", "type": "seen", "source": "https://gist.github.com/alon710/fe6f5c87f44e8737a1f8abea57fa2cd5", "content": "# CVE-2026-55596: CVE-2026-55596: DOM-based Cross-Site Scripting (XSS) in Plate Media Embed Component\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55596\n\n## Summary\nCVE-2026-55596 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability in the Plate rich-text editor framework (specifically within the @platejs/media package). The issue stems from an optimization fast-path that short-circuits safety parsing if a provider or source URL is already declared on an element. Consequently, serialized documents carrying malicious javascript: URLs bypass protocol sanitization and are loaded directly into iframe elements, leading to code execution.\n\n## TL;DR\nA validation bypass in Plate's media component allows unauthenticated DOM-based XSS when rendering crafted document nodes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Score**: 8.7\n- **EPSS Score**: 0.0043\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @platejs/media\n- platejs\n- @platejs/utils\n- @platejs/core\n- **@platejs/media**: >= 53.0.0, < 53.1.4 (Fixed in: `53.1.4`)\n\n## Mitigation\n\n- Upgrade @platejs/media to version 53.1.4 or newer.\n- Implement client-side component wrappers that sanitize iframe URLs against malicious protocols.\n- Filter rich-text schema objects at the API ingress layer to sanitize URL protocols.\n\n**Remediation Steps:**\n1. Identify all deployments using @platejs/media or related monorepo packages.\n2. Execute dependency updates using standard package management tools (npm, yarn, pnpm).\n3. Deploy code modifications to enforce schema validation for saved media components in existing documents.\n\n## References\n\n- [GitHub Security Advisory GHSA-qj6x-xx2h-8hvv](https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv)\n- [Vulnerability Fix Pull Request (PR #5014)](https://github.com/udecode/plate/pull/5014)\n- [Vulnerability Fix Commit](https://github.com/udecode/plate/commit/6214914ca811adf22d0ad503154494216eed68ba)\n- [Plate Version v53.1.4 Release Notes](https://github.com/udecode/plate/releases/tag/v53.1.4)\n- [NVD Vulnerability Detail Page](https://nvd.nist.gov/vuln/detail/CVE-2026-55596)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55596) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-25T17:32:46.022528Z"}