CVE-2026-55596: CVE-2026-55596: DOM-based Cross-Site Scripting (XSS) in Plate Media Embed Component

#security #cve #cybersecurity

CVE-2026-55596: DOM-based Cross-Site Scripting (XSS) in Plate Media Embed Component

Vulnerability ID: CVE-2026-55596
CVSS Score: 8.7
Published: 2026-08-25

CVE-2026-55596 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability in the Plate rich-text editor framework (specifically within the @platejs/media package). The issue stems from an optimization fast-path that short-circuits safety parsing if a provider or source URL is already declared on an element. Consequently, serialized documents carrying malicious javascript: URLs bypass protocol sanitization and are loaded directly into iframe elements, leading to code execution.

TL;DR

A validation bypass in Plate's media component allows unauthenticated DOM-based XSS when rendering crafted document nodes.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-79
Attack Vector: Network
CVSS Score: 8.7
EPSS Score: 0.0043
Exploit Status: poc
KEV Status: Not Listed

Affected Systems

@platejs/media
platejs
@platejs/utils
@platejs/core
@platejs/media: >= 53.0.0, < 53.1.4 (Fixed in: 53.1.4)

Code Analysis

Commit: 6214914

Fix media embed URL sanitization (#5014)

@@ -23,9 +23,1 @@\n-    if (element.provider || element.sourceUrl) {\n-      return {\n-        id: element.id,\n-        provider: element.provider,\n-        sourceUrl: element.sourceUrl,\n-        url,\n-      };\n-    }\n-\n     return parseMediaUrl(url, { urlParsers });

Exploit Details

GitHub Security Advisory: Advisory context containing PoC tests verifying XSS bypass mechanism.

Mitigation Strategies

Upgrade @platejs/media to version 53.1.4 or newer.
Implement client-side component wrappers that sanitize iframe URLs against malicious protocols.
Filter rich-text schema objects at the API ingress layer to sanitize URL protocols.

Remediation Steps:

Identify all deployments using @platejs/media or related monorepo packages.
Execute dependency updates using standard package management tools (npm, yarn, pnpm).
Deploy code modifications to enforce schema validation for saved media components in existing documents.

References

Read the full report for CVE-2026-55596 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community