Listen to this Post
The @platejs/docx-io library, a component of the Plate rich-text editor, is vulnerable to a high-severity Server-Side Request Forgery (SSRF) attack identified as CVE-2026-65842. The core of the issue lies in the `htmlToDocxBlob` function, which is responsible for converting HTML content into DOCX files.
When this function processes HTML that contains `` tags with `src` attributes pointing to remote URLs, it automatically fetches the image from that external location and embeds the retrieved binary data into the resulting DOCX document. This behavior, while potentially a feature for legitimate use, becomes a critical security flaw when the HTML input is supplied by an untrusted or attacker-controlled source.
An attacker can craft a malicious HTML document with an image source pointing to an internal, non-public network resource (e.g., http://192.168.1.1/admin`,http://internal-api:8080/secret`). When a vulnerable application processes this HTML on a server, the server’s environment will make an outbound request to that internal URL. The library then includes the response from this internal service as “image data” in the final DOCX file. This allows an attacker to effectively probe the server’s internal network, discover open ports, and exfiltrate sensitive data from internal services that are not directly accessible from the internet. Furthermore, an attacker could point the URL to a massive file, causing resource exhaustion on the server performing the conversion. This vulnerability is classified as High severity with a CVSS score of 8.2.
DailyCVE Form:
Platform: ……. Node.js / Server
Version: …….. < 53.3.2
Vulnerability :…… SSRF + Disclosure
Severity: ……. High (CVSS 8.2)
date: ………. 2026-08-20
Prediction: ……. 2026-09-10
What Undercode Say:
The SSRF vulnerability is triggered within the `buildImage` and `buildParagraph` functions during the DOCX rendering process. While no public exploit is currently available, the ease of exploitation and the potential for high impact make this a significant threat. The vulnerability is trivial to reproduce with a simple HTML payload.
Exploit: (Educational Purposes!)
To demonstrate the vulnerability, an attacker could provide the following HTML string to a vulnerable application’s DOCX conversion endpoint:
<html> <body> <img src="http://169.254.169.254/latest/meta-data/" /> <img src="http://192.168.1.1/config" /> </body> </html>
Upon conversion, the server would attempt to fetch the contents of these internal URLs and embed them into the DOCX file, exposing sensitive information from the internal network.
Protection:
The primary and most effective mitigation is to upgrade the `@platejs/docx-io` package to version 53.3.2 or later.
If an immediate upgrade is not possible, implement these workarounds:
1. Sanitize Input: Strictly sanitize all untrusted HTML to remove or neutralize any `` tags with `src` attributes pointing to remote URLs.
2. Pre-convert Images: Before passing HTML to the library, convert all required images into Base64-encoded Data URIs.
3. Network Isolation: Run the DOCX conversion process in a sandboxed environment with strict outbound network access controls (e.g., a firewall or network policy that prevents access to internal IP ranges).
Impact:
- Confidentiality (High): An attacker can read sensitive data from internal network resources, such as cloud metadata endpoints, internal APIs, and configuration files.
- Availability (Low): An attacker can cause resource exhaustion on the server by forcing it to download large files from a remote location.
- Integrity (None): The vulnerability does not allow for modification of data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
