Skip to content
Patch Next
Sign inAdd to your agent

← Actionable
High, CVSS 8.7amended

Plate allows arbitrary DOM attributes in element.attributes and leaf.attributes

CVE-2024-47061GHSA-73rg-f94j-xvhx

What to do

Vendor fix available. Upgrade each affected package to the fixed version on its release line (@udecode/plate-core 38.0.6, 36.5.9, 21.5.1), redeploy, then verify what is actually installed.

This page has no inventory attached, so it cannot say whether you are affected. A vendor fix is not proof that your deployment is fixed.

Add to your agent

Affected packages

  • npm @udecode/plate-core

    Affected
    >= 37.0.0, < 38.0.6>= 22.0.0, < 36.5.9< 21.5.1
    Fixed in
    38.0.6, 36.5.9, 21.5.1

Sources

Severity and exploitation
Exploitation
No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.
CVSS 4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N · score source
EPSS
  • CVE-2024-47061: 0.52% estimated exploitation activity in the next 30 days; percentile 43.93 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.
Source description

As published by the source; long descriptions are shortened.

Impact One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the attributes property. These attributes are passed to the node component using the nodeProps prop. Note: The attributes prop that is typically rendered alongside nodeProps is unrelated. It has come to our attention that this feature can be used for malicious purposes, including cross-site scripting (XSS) and information exposure (specifically, users' IP addresses and whether or not they have opened a malicious document). Note that the risk of information exposure via attributes is only relevant to applications in which web requests to arbitrary URLs are not ordinarily allowed. Plate editors that allow users to embed images from arbitrary URLs, for example, already carry the risk of leaking users' IP addresses to third parties. All Plate editors using an affected version of @udecode/plate-core are vulnerable to these information exposure attacks via the style attribute…

Dates and revisions
Published by the source
Last modified by the source
Source last checked
  1. Revision 3 · amended ·

    Amended from ghsa record GHSA-73rg-f94j-xvhx

  2. Revision 2 · amended ·

    Reviewed OSV alias/range/CVSS4 correction; package source scopes and original publication preserved. No customer finding resolved.

  3. Revision 1 · created ·

    Published from osv record GHSA-73rg-f94j-xvhx

Agent brief

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2024-47061

Advisory: Plate allows arbitrary DOM attributes in element.attributes and leaf.attributes
IDs: CVE-2024-47061, GHSA-73rg-f94j-xvhx
Record: https://patchnext.com/advisories/cve-2024-47061 (revision 3, source checked 26 Oct 2026, 12:31 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.7)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: @udecode/plate-core 38.0.6, 36.5.9, 21.5.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm @udecode/plate-core: affected >= 37.0.0, < 38.0.6; >= 22.0.0, < 36.5.9; < 21.5.1; fixed in 38.0.6, 36.5.9, 21.5.1

## Suggested inspection (read-only)
- `npm ls @udecode/plate-core --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on @udecode/plate-core.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-73rg-f94j-xvhx (OSV record GHSA-73rg-f94j-xvhx lists affected ranges: npm @udecode/plate-core >=37.0.0 =22.0.0 =0 <21.5.1 (fixed))
- Verified: https://github.com/advisories/GHSA-73rg-f94j-xvhx (GitHub-reviewed advisory GHSA-73rg-f94j-xvhx lists affected ranges: npm @udecode/plate-core >=37.0.0 =22.0.0 =0 <21.5.1)

Commands are suggestions: review each one before running it.

Loading voting…