CVE-2026-88976 Details
Description
Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs, certain HTML attributes can trigger browser behavior before the HTML is converted into editor nodes. This can allow attacker-controlled script to execute in the consuming application's origin when another user loads the deserialized content. This issue is fixed in version 53.3.11.
A vulnerability exists in the Plate rich-text editor, specifically in versions prior to 53.3.11 and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds. The issue arises in the core HTML deserialization APIs, which parse HTML strings in the active document. When an application deserializes untrusted or cross-user HTML, certain attributes can trigger browser behaviors before the HTML is converted into editor nodes. This could enable the execution of attacker-controlled scripts in the application's origin when another user loads the deserialized content.
Users should upgrade to Plate version 53.3.11 or later. Those on the discontinued 54.0.0 beta builds should switch to the latest stable release. Additionally, applications should sanitize untrusted HTML before rendering it, as inert parsing does not replace the need for proper sanitization.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/udecode/plate/commit/d02afe45d5ec3a9fb95e0745bc5820ff18a3c12b | [email protected] | Source CodeVendor |
| https://github.com/udecode/plate/pull/5117 | [email protected] | Source CodeVendor |
| https://github.com/udecode/plate/releases/tag/v53.3.11 | [email protected] | Release NotesVendor |
| https://github.com/udecode/plate/security/advisories/GHSA-qrfj-mgw8-j9c6 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| udecode Plate | < 53.3.11 (semver) >= 54.0.0-beta.0, <= 54.0.0-beta.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |