@platejs/core HTML deserialization can trigger browser behavior during parsing
Summary
HTML strings passed to Plate's core deserialization APIs were parsed in the active document. Certain HTML attributes could therefore trigger browser behavior during parsing, before the content was converted into editor nodes.
Applications that deserialize HTML from untrusted or cross-user sources may be affected.
Impact
An attacker who can control HTML later deserialized in another user's browser may be able to execute script in that application's origin.
Remediation
Upgrade to @platejs/core 53.3.11 or later. Users of the discontinued 54.0.0 beta builds should install the fixed stable line. Applications should also sanitize untrusted HTML before rendering it; inert parsing is not a substitute for sanitization.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @platejs/core | < 53.3.11, >= 54.0.0-beta.0, <= 54.0.0-beta.1 | 53.3.11 |
References
- https://github.com/udecode/plate/security/advisories/GHSA-qrfj-mgw8-j9c6
- https://nvd.nist.gov/vuln/detail/CVE-2026-88976
- https://github.com/udecode/plate/pull/5117
- https://github.com/udecode/plate/commit/d02afe45d5ec3a9fb95e0745bc5820ff18a3c12b
- https://github.com/udecode/plate
- https://github.com/udecode/plate/releases/tag/v53.3.11
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- npm
- Package
@platejs/core- Disclosed
- 17.09.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-qrfj-mgw8-j9c6 - CC BY 4.0
Vulnerability history: @platejs/core
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.