High, CVSS 8.7npmPublished
Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript
CVE-2026-55596 · GHSA-qj6x-xx2h-8hvv
- Affected
- npm @platejs/media >= 53.0.0, < 53.1.4
- Fixed in
- 53.1.4· Vendor fix available
- Issue
- The media embed renderer trusts serialized provider or sourceUrl metadata and skips the URL protocol validation that normally blocks unsafe media embed URLs. A crafted Plate document can set a known video provider while keeping url as a javascript: iframe source. When a victim opens that document in an app using the registry media embed component, the component renders the attacker URL directly as an iframe src. Impact An attacker who can create or share Plate document content with another user can execute JavaScript in the victim browser context when the victim opens the document. This can expose application data available to the page and perform actions as the victim, depending on the host application's session model. Reproduction Use a Plate editor or viewer that renders media embeds with the registry MediaEmbedElement and load a document containing this node: When rendered, the node is treated as a Vimeo media embed because provider is present. The iframe receives the…
Recommended action: Upgrade to 53.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.