DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-65842: CVE-2026-65842: Server-Side Request Forgery with Response Disclosure in @platejs/docx-io

#security #cve #cybersecurity

CVE-2026-65842: Server-Side Request Forgery with Response Disclosure in @platejs/docx-io

Vulnerability ID: CVE-2026-65842
CVSS Score: 8.2
Published: 2026-09-02

CVE-2026-65842 is a high-severity Server-Side Request Forgery (SSRF) vulnerability with response disclosure in the @platejs/docx-io package of the Plate rich-text editor ecosystem. Prior to version 53.3.2, the library parsed HTML image tags and unconditionally fetched remote URL resources. Because the server-side response is subsequently encoded and compiled into the generated DOCX file, an attacker can extract sensitive internal data such as local API endpoints, private network configurations, or cloud instance metadata (IMDS) from the downloaded document structure.

TL;DR

An SSRF flaw in @platejs/docx-io prior to 53.3.2 allows unauthenticated remote attackers to trigger outbound requests to internal resources and extract the full response content from the generated DOCX file.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 8.2 (High)
  • Confidentiality Impact: High (C:H)
  • Exploit Status: PoC (Proof of Concept)
  • CISA KEV Status: Not Listed

Affected Systems

  • @platejs/docx-io (< 53.3.2)
  • Applications utilizing Plate's HTML-to-DOCX export capabilities on the server-side
  • @platejs/docx-io: < 53.3.2 (Fixed in: 53.3.2)

Code Analysis

Commit: 21aa599

Fix: SSRF security vulnerability when exporting documents by disabling remote images by default and adding the allowRemoteImages option

Exploit Details

  • GitHub Security Advisory: Information on the initial discovery and verification process for the server-side request forgery vulnerability.

Mitigation Strategies

  • Upgrade @platejs/docx-io to version 53.3.2 or higher.
  • Keep allowRemoteImages disabled (default) to block all outbound image fetching.
  • Pre-process trusted images into base64 data URIs on the client-side rather than allowing server-side fetching.

Remediation Steps:

  1. Open the project's package.json file and locate @platejs/docx-io.
  2. Update the version definition to '^53.3.2' or higher.
  3. Run your package manager installation command (e.g., 'npm install' or 'yarn install') to apply changes and update the lockfile.
  4. Audit any files where htmlToDocxBlob is called to ensure 'allowRemoteImages: true' is not explicitly set when processing untrusted user input.

References

Read the full report for CVE-2026-65842 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)