{"id":"EUVD-2026-42395","revision":"8dae4077f2dc47c0a8b3e331e70fb827","records":[{"revision":"8dae4077f2dc47c0a8b3e331e70fb827","observedAt":"2026-10-30T09:56:15.908+00:00","statement":{"source":"euvd","id":"EUVD-2026-42395","aliases":["CVE-2026-55596","GHSA-qj6x-xx2h-8hvv"],"title":"Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate do…","description":"Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as a javascript: iframe source that the registry MediaEmbedElement renders directly as an iframe src when a victim opens the document. This issue is fixed in version 53.1.4.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","score":8.7,"severity":null}],"references":["https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv","https://github.com/udecode/plate/pull/5014","https://github.com/udecode/plate/commit/6214914ca811adf22d0ad503154494216eed68ba","https://github.com/udecode/plate/releases/tag/v53.1.4"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42395","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 8, 2026, 8:27:58 PM","dateUpdated":"Jul 9, 2026, 1:41:00 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-42395","identifiers":["EUVD-2026-42395","CVE-2026-55596","GHSA-qj6x-xx2h-8hvv"]},"retained":false,"historicalAffected":[]}],"coverage":[]}