CVE-2026-88976 (GCVE-0-2026-88976)
Vulnerability from cvelistv5
Published
2026-09-16 14:11
Modified
2026-09-16 15:25
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs, certain HTML attributes can trigger browser behavior before the HTML is converted into editor nodes. This can allow attacker-controlled script to execute in the consuming application's origin when another user loads the deserialized content. This issue is fixed in version 53.3.11.
References
Impacted products
Vendor Product Version
udecode plate Version: < 53.3.11
Version: >= 54.0.0-beta.0, <= 54.0.0-beta.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-88976",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T15:24:04.653416Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:25:38.481Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "plate",
          "vendor": "udecode",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 53.3.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 54.0.0-beta.0, \u003c= 54.0.0-beta.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs, certain HTML attributes can trigger browser behavior before the HTML is converted into editor nodes. This can allow attacker-controlled script to execute in the consuming application\u0027s origin when another user loads the deserialized content. This issue is fixed in version 53.3.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:11:39.881Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/udecode/plate/security/advisories/GHSA-qrfj-mgw8-j9c6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/udecode/plate/security/advisories/GHSA-qrfj-mgw8-j9c6"
        },
        {
          "name": "https://github.com/udecode/plate/pull/5117",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/udecode/plate/pull/5117"
        },
        {
          "name": "https://github.com/udecode/plate/commit/d02afe45d5ec3a9fb95e0745bc5820ff18a3c12b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/udecode/plate/commit/d02afe45d5ec3a9fb95e0745bc5820ff18a3c12b"
        },
        {
          "name": "https://github.com/udecode/plate/releases/tag/v53.3.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/udecode/plate/releases/tag/v53.3.11"
        }
      ],
      "source": {
        "advisory": "GHSA-qrfj-mgw8-j9c6",
        "discovery": "UNKNOWN"
      },
      "title": "@platejs/core HTML deserialization can trigger browser behavior during parsing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-88976",
    "datePublished": "2026-09-16T14:11:39.881Z",
    "dateReserved": "2026-09-10T16:02:31.342Z",
    "dateUpdated": "2026-09-16T15:25:38.481Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-88976\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-16T15:24:04.653416Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-16T15:24:13.346Z\"}}], \"cna\": {\"title\": \"@platejs/core HTML deserialization can trigger browser behavior during parsing\", \"source\": {\"advisory\": \"GHSA-qrfj-mgw8-j9c6\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"udecode\", \"product\": \"plate\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 53.3.11\"}, {\"status\": \"affected\", \"version\": \"\u003e= 54.0.0-beta.0, \u003c= 54.0.0-beta.1\"}]}], \"references\": [{\"url\": \"https://github.com/udecode/plate/security/advisories/GHSA-qrfj-mgw8-j9c6\", \"name\": \"https://github.com/udecode/plate/security/advisories/GHSA-qrfj-mgw8-j9c6\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/udecode/plate/pull/5117\", \"name\": \"https://github.com/udecode/plate/pull/5117\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/udecode/plate/commit/d02afe45d5ec3a9fb95e0745bc5820ff18a3c12b\", \"name\": \"https://github.com/udecode/plate/commit/d02afe45d5ec3a9fb95e0745bc5820ff18a3c12b\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/udecode/plate/releases/tag/v53.3.11\", \"name\": \"https://github.com/udecode/plate/releases/tag/v53.3.11\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs, certain HTML attributes can trigger browser behavior before the HTML is converted into editor nodes. This can allow attacker-controlled script to execute in the consuming application\u0027s origin when another user loads the deserialized content. This issue is fixed in version 53.3.11.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-16T14:11:39.881Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-88976\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-16T15:25:38.481Z\", \"dateReserved\": \"2026-09-10T16:02:31.342Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-16T14:11:39.881Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.