CVE-2026-88976: HTML Deserialization Cross-Site Scripting in @platejs/core
Vulnerability ID: CVE-2026-88976
CVSS Score: 6.1
Published: 2026-09-17
Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs, certain HTML attributes can trigger browser behavior before the HTML is converted into editor nodes.
TL;DR
A flaw in the HTML deserialization routines of @platejs/core prior to 53.3.11 allowed remote attackers to execute arbitrary client-side scripts via unauthenticated user interaction with crafted HTML payloads.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-79
- Attack Vector: Network (AV:N)
- CVSS Score: 6.1 (Medium)
- EPSS Score: N/A
- Exploit Status: PoC (Proof-of-Concept)
- KEV Status: Not Listed
Affected Systems
- @platejs/core
-
@platejs/core: < 53.3.11 (Fixed in:
53.3.11) -
@platejs/core: >= 54.0.0-beta.0 <= 54.0.0-beta.1 (Fixed in:
53.3.11)
Code Analysis
Commit: d02afe4
Fix HTML deserialization XSS
Mitigation Strategies
- Upgrade @platejs/core to version 53.3.11 or above.
- Apply secondary server-side and client-side sanitization using DOMPurify.
- Implement a strong Content Security Policy (CSP) to restrict inline script execution.
Remediation Steps:
- Identify all deployments of udecode/plate in package.json files.
- Run 'npm install @platejs/core@53.3.11' or equivalent package manager commands to upgrade the dependencies.
- Verify that DOMParser is successfully utilized in built client bundles for HTML deserialization.
- Sanitize all rich text data parsed or exported from the editor using a secure library.
References
Read the full report for CVE-2026-88976 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)