{"vulnerability": "CVE-2026-65842", "sightings": [{"uuid": "d8059950-4139-41df-bf52-97d065e6f23a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-65842", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mul46l4zvz2q", "content": "@platejs/docx-io fetches remote image URLs while converting HTML to DOCX, and the fetched image data lands in the generated file (CVE-2026-65842, high). The advisory bounds it to apps converting untrusted HTML server-side or in a privileged environment. #dev", "creation_timestamp": "2026-09-02T23:38:43.317142Z"}, {"uuid": "b4e6ae91-4ff6-4cc7-a595-4fba9cd86459", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-65842", "type": "seen", "source": "https://gist.github.com/alon710/b49a4882cbb663c91159acdfe34ae468", "content": "# CVE-2026-65842: CVE-2026-65842: Server-Side Request Forgery with Response Disclosure in @platejs/docx-io\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-65842\n\n## Summary\nCVE-2026-65842 is a high-severity Server-Side Request Forgery (SSRF) vulnerability with response disclosure in the @platejs/docx-io package of the Plate rich-text editor ecosystem. Prior to version 53.3.2, the library parsed HTML image tags and unconditionally fetched remote URL resources. Because the server-side response is subsequently encoded and compiled into the generated DOCX file, an attacker can extract sensitive internal data such as local API endpoints, private network configurations, or cloud instance metadata (IMDS) from the downloaded document structure.\n\n## TL;DR\nAn SSRF flaw in @platejs/docx-io prior to 53.3.2 allows unauthenticated remote attackers to trigger outbound requests to internal resources and extract the full response content from the generated DOCX file.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 8.2 (High)\n- **Confidentiality Impact**: High (C:H)\n- **Exploit Status**: PoC (Proof of Concept)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- @platejs/docx-io (< 53.3.2)\n- Applications utilizing Plate's HTML-to-DOCX export capabilities on the server-side\n- **@platejs/docx-io**: < 53.3.2 (Fixed in: `53.3.2`)\n\n## Mitigation\n\n- Upgrade @platejs/docx-io to version 53.3.2 or higher.\n- Keep allowRemoteImages disabled (default) to block all outbound image fetching.\n- Pre-process trusted images into base64 data URIs on the client-side rather than allowing server-side fetching.\n\n**Remediation Steps:**\n1. Open the project's package.json file and locate @platejs/docx-io.\n2. Update the version definition to '^53.3.2' or higher.\n3. Run your package manager installation command (e.g., 'npm install' or 'yarn install') to apply changes and update the lockfile.\n4. Audit any files where htmlToDocxBlob is called to ensure 'allowRemoteImages: true' is not explicitly set when processing untrusted user input.\n\n## References\n\n- [GitHub Security Advisory GHSA-4q39-2jhr-7qx8](https://github.com/udecode/plate/security/advisories/GHSA-4q39-2jhr-7qx8)\n- [Official Pull Request #5053](https://github.com/udecode/plate/pull/5053)\n- [Fix Commit](https://github.com/udecode/plate/commit/21aa59926f4bbd421027354823cca09c6700ed73)\n- [Release v53.3.2](https://github.com/udecode/plate/releases/tag/v53.3.2)\n- [NVD CVE-2026-65842 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-65842)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-65842)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-65842) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T10:32:33.995793Z"}]}