{"metadata": {"vulnerability": "CVE-2026-55596", "count": 15, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-06-16T23:18:03.170Z", "date_only": false, "value": "2026-06-16T23:18:03.170Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-55596", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-08T20:27:58.987Z", "date_only": false, "value": "2026-07-08T20:27:58.987Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-55596", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-08T20:27:58.987Z", "date_only": false, "value": "2026-07-08T20:27:58.987Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-55596", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-08T21:16:50Z", "date_only": false, "value": "2026-07-08T21:16:50Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-QJ6X-XX2H-8HVV", "record": "GHSA-QJ6X-XX2H-8HVV", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-07-08T21:16:50.247Z", "date_only": false, "value": "2026-07-08T21:16:50.247", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55596", "record": "FKIE_CVE-2026-55596", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-08T22:35:17.631Z", "date_only": false, "value": "2026-07-08T22:35:17.631126Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq66jmihnl27", "record": "CVE-2026-55596", "field": "creation_timestamp", "uuid": "1d3f0c46-689c-4748-bb55-82b1ca75acea", "content": "CVE-2026-55596 - Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript\nCVE ID : CVE-2026-55596\n \n Published : July 8, 2026, 8:27 p.m. | 32\u00a0minutes ago\n \n Description : Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq66jmihnl27"}, {"timestamp": "2026-07-09T13:40:39.729Z", "date_only": false, "value": "2026-07-09T13:40:39.729677Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-55596", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-09T13:40:39.729Z", "date_only": false, "value": "2026-07-09T13:40:39.729677Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55596", "record": "FKIE_CVE-2026-55596", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-09T13:41:00.054Z", "date_only": false, "value": "2026-07-09T13:41:00.054Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-55596", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-09T13:41:00.054Z", "date_only": false, "value": "2026-07-09T13:41:00.054Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-55596", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-25T16:29:25Z", "date_only": false, "value": "2026-08-25T16:29:25Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-QJ6X-XX2H-8HVV", "record": "GHSA-QJ6X-XX2H-8HVV", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-25T16:29:25Z", "date_only": false, "value": "2026-08-25T16:29:25Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-QJ6X-XX2H-8HVV", "record": "GHSA-QJ6X-XX2H-8HVV", "field": "modified"}, {"timestamp": "2026-08-25T17:32:46.022Z", "date_only": false, "value": "2026-08-25T17:32:46.022528Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/fe6f5c87f44e8737a1f8abea57fa2cd5", "record": "CVE-2026-55596", "field": "creation_timestamp", "uuid": "20e82656-df69-4731-ac96-b8a84b7d58b1", "content": "# CVE-2026-55596: CVE-2026-55596: DOM-based Cross-Site Scripting (XSS) in Plate Media Embed Component\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55596\n\n## Summary\nCVE-2026-55596 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability in the Plate rich-text editor framework (specifically within the @platejs/media package). The issue stems from an optimization fast-path that short-circuits safety parsing if a provider or source URL is already declared on an element. Consequently, serialized documents carrying malicious javascript: URLs bypass protocol sanitization and are loaded directly into iframe elements, leading to code execution.\n\n## TL;DR\nA validation bypass in Plate's media component allows unauthenticated DOM-based XSS when rendering crafted document nodes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Score**: 8.7\n- **EPSS Score**: 0.0043\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @platejs/media\n- platejs\n- @platejs/utils\n- @platejs/core\n- **@platejs/media**: >= 53.0.0, < 53.1.4 (Fixed in: `53.1.4`)\n\n## Mitigation\n\n- Upgrade @platejs/media to version 53.1.4 or newer.\n- Implement client-side component wrappers that sanitize iframe URLs against malicious protocols.\n- Filter rich-text schema objects at the API ingress layer to sanitize URL protocols.\n\n**Remediation Steps:**\n1. Identify all deployments using @platejs/media or related monorepo packages.\n2. Execute dependency updates using standard package management tools (npm, yarn, pnpm).\n3. Deploy code modifications to enforce schema validation for saved media components in existing documents.\n\n## References\n\n- [GitHub Security Advisory GHSA-qj6x-xx2h-8hvv](https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv)\n- [Vulnerability Fix Pull Request (PR #5014)](https://github.com/udecode/plate/pull/5014)\n- [Vulnerability Fix Commit](https://github.com/udecode/plate/commit/6214914ca811adf22d0ad503154494216eed68ba)\n- [Plate Version v53.1.4 Release Notes](https://github.com/udecode/plate/releases/tag/v53.1.4)\n- [NVD Vulnerability Detail Page](https://nvd.nist.gov/vuln/detail/CVE-2026-55596)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55596) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/fe6f5c87f44e8737a1f8abea57fa2cd5"}, {"timestamp": "2026-08-25T18:35:09.241Z", "date_only": false, "value": "2026-08-25T18:35:09.241936Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv", "record": "CVE-2026-55596", "field": "creation_timestamp", "uuid": "026182fb-d659-49df-98d6-c9fdb6fdfe92", "url": "https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-25T17:10:00.197Z", "date_only": false, "value": "2026-10-25T17:10:00.197", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55596", "record": "FKIE_CVE-2026-55596", "field": "lastModified"}], "metrics": {"as_of": "2026-10-28T19:24:08.223Z", "anchors": {"origin": {"timestamp": "2026-07-08T20:27:58.987Z", "date_only": false, "value": "2026-07-08T20:27:58.987Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-55596", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-07-08T20:27:58.987Z", "date_only": false, "value": "2026-07-08T20:27:58.987Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-55596", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-08-25T18:35:09.241Z", "date_only": false, "value": "2026-08-25T18:35:09.241936Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv", "record": "CVE-2026-55596", "field": "creation_timestamp", "uuid": "026182fb-d659-49df-98d6-c9fdb6fdfe92", "url": "https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 4140430.254, "hours": 1150.119515, "days": 47.921646458333335, "min_seconds": 4140430.254, "max_seconds": 4140430.254, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-08T20:27:58.987Z", "date_only": false, "value": "2026-07-08T20:27:58.987Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-55596", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-08-25T18:35:09.241Z", "date_only": false, "value": "2026-08-25T18:35:09.241936Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv", "record": "CVE-2026-55596", "field": "creation_timestamp", "uuid": "026182fb-d659-49df-98d6-c9fdb6fdfe92", "url": "https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 9672969.236635, "hours": 2686.9358990652777, "days": 111.95566246105324, "min_seconds": 9672969.236635, "max_seconds": 9672969.236635, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-08T20:27:58.987Z", "date_only": false, "value": "2026-07-08T20:27:58.987Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-55596", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-28T19:24:08.223Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 5532538.982635, "hours": 1536.8163840652778, "days": 64.03401600271991, "min_seconds": 5532538.982635, "max_seconds": 5532538.982635, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-25T18:35:09.241Z", "date_only": false, "value": "2026-08-25T18:35:09.241936Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv", "record": "CVE-2026-55596", "field": "creation_timestamp", "uuid": "026182fb-d659-49df-98d6-c9fdb6fdfe92", "url": "https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-28T19:24:08.223Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}