@platejs/core HTML deserialization can trigger browser behavior during parsing

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-88976 · CVE overview and exploitation status

EUVD-2026-80782

GHSA-qrfj-mgw8-j9c6

cve-program · CVE-2026-88976

• https://github.com/udecode/plate/security/advisories/GHSA-qrfj-mgw8-j9c6
• https://github.com/udecode/plate/pull/5117
• https://github.com/udecode/plate/commit/d02afe45d5ec3a9fb95e0745bc5820ff18a3c12b
• https://github.com/udecode/plate/releases/tag/v53.3.11

euvd · EUVD-2026-80782

• https://github.com/udecode/plate/security/advisories/GHSA-qrfj-mgw8-j9c6
• https://github.com/udecode/plate/pull/5117
• https://github.com/udecode/plate/commit/d02afe45d5ec3a9fb95e0745bc5820ff18a3c12b
• https://github.com/udecode/plate/releases/tag/v53.3.11

nvd · CVE-2026-88976

• https://github.com/udecode/plate/commit/d02afe45d5ec3a9fb95e0745bc5820ff18a3c12b
• https://github.com/udecode/plate/pull/5117
• https://github.com/udecode/plate/releases/tag/v53.3.11
• https://github.com/udecode/plate/security/advisories/GHSA-qrfj-mgw8-j9c6

osv · GHSA-qrfj-mgw8-j9c6

• https://github.com/udecode/plate/security/advisories/GHSA-qrfj-mgw8-j9c6
• https://nvd.nist.gov/vuln/detail/CVE-2026-88976
• https://github.com/udecode/plate/pull/5117
• https://github.com/udecode/plate/commit/d02afe45d5ec3a9fb95e0745bc5820ff18a3c12b
• https://github.com/udecode/plate
• https://github.com/udecode/plate/releases/tag/v53.3.11

No related changes are available here.