CVE-2026-55596 Details
Description
Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as a javascript: iframe source that the registry MediaEmbedElement renders directly as an iframe src when a victim opens the document. This issue is fixed in version 53.1.4.
A vulnerability in the Plate rich-text editor, specifically in versions 53.0.0 prior to 53.1.4, allows for the execution of JavaScript in the context of the victim's browser. This issue arises because the media embed renderer trusts serialized provider or sourceUrl metadata and bypasses crucial URL protocol validation. As a result, a crafted Plate document can embed a video from a known provider while using a 'javascript:' URL as the source for an iframe. When the document is opened, the registry MediaEmbedElement renders the iframe with the unvalidated JavaScript URL, executing it in the process.
Users are advised to upgrade to Plate version 53.1.4 or later. After updating, ensure that the 'provider', 'sourceUrl', and 'id' in serialized documents are treated as untrusted metadata. Recompute embed metadata from the 'url' using the 'parseMediaUrl' function, or at a minimum, validate any fast-path 'url' with the same protocol allowlist before rendering an iframe.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/udecode/plate/commit/6214914ca811adf22d0ad503154494216eed68ba | [email protected] | Source CodeVendor |
| https://github.com/udecode/plate/pull/5014 | [email protected] | Source CodeVendor |
| https://github.com/udecode/plate/releases/tag/v53.1.4 | [email protected] | Release NotesVendor |
| https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| udecode Plate | >= 53.0.0, < 53.1.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |