{"id":"EUVD-2026-42395","enisaUuid":"5c604211-9e3f-3ac5-9f0e-becbb9498ffb","description":"Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as a javascript: iframe source that the registry MediaEmbedElement renders directly as an iframe src when a victim opens the document. This issue is fixed in version 53.1.4.","datePublished":"Jul 8, 2026, 8:27:58 PM","dateUpdated":"Jul 9, 2026, 1:41:00 PM","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv\nhttps://github.com/udecode/plate/pull/5014\nhttps://github.com/udecode/plate/commit/6214914ca811adf22d0ad503154494216eed68ba\nhttps://github.com/udecode/plate/releases/tag/v53.1.4\n","aliases":"CVE-2026-55596\nGHSA-qj6x-xx2h-8hvv\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"a151fbae-7bfa-3fe5-854c-7e1f8e5eac28","product":{"name":"plate","vendor":{"name":"udecode"}},"product_version":"53.0.0, \u003c 53.1.4"}],"enisaIdVendor":[{"id":"b094b836-65ff-3f0d-aeea-1e76bc7d8e4e","vendor":{"name":"udecode"}}],"enisaIdVulnerability":[{"id":"e394bcf5-b571-3ad2-bb29-fb313064551e","vulnerability":{"id":"GHSA-qj6x-xx2h-8hvv","description":"Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript","datePublished":"Aug 25, 2026, 4:29:25 PM","dateUpdated":"Aug 25, 2026, 4:29:25 PM","baseScore":0.0,"references":"https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-55596\nhttps://github.com/udecode/plate/pull/5014\nhttps://github.com/udecode/plate/commit/6214914ca811adf22d0ad503154494216eed68ba\nhttps://github.com/udecode/plate\nhttps://github.com/udecode/plate/releases/tag/v53.1.4\n","enisa_id":"EUVD-2026-42395\n","aliases":"CVE-2026-55596\nGHSA-qj6x-xx2h-8hvv\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:59:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f45f15a9-0526-37a1-a67a-26fa98dd5d20","vulnerability":{"id":"CVE-2026-55596","description":"Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as a javascript: iframe source that the registry MediaEmbedElement renders directly as an iframe src when a victim opens the document. This issue is fixed in version 53.1.4.","datePublished":"Jul 8, 2026, 8:27:58 PM","dateUpdated":"Jul 9, 2026, 1:41:00 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv\nhttps://github.com/udecode/plate/pull/5014\nhttps://github.com/udecode/plate/commit/6214914ca811adf22d0ad503154494216eed68ba\nhttps://github.com/udecode/plate/releases/tag/v53.1.4\n","enisa_id":"EUVD-2026-42395\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Oct 30, 2026, 7:16:28 AM","vulnerabilityProduct":[{"id":"63365d8a-87dc-3fc0-ae8b-b4d9ddf669f9","product":{"name":"plate","vendor":{"name":"udecode"}},"product_version":"53.0.0, \u003c 53.1.4"}],"vulnerabilityVendor":[{"id":"69abb2cb-0f9e-3400-8a1b-039c9225a898","vendor":{"name":"udecode"}}]}}],"enisaIdAdvisory":[]}