{"uuid": "bc9126c3-fbd2-4a18-82c1-61a018398fae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88976", "type": "seen", "source": "https://gist.github.com/alon710/597e5b2d04a8f95b06b03a350d6e8b1e", "content": "# CVE-2026-88976: CVE-2026-88976: HTML Deserialization Cross-Site Scripting in @platejs/core\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88976\n\n## Summary\nPlate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs, certain HTML attributes can trigger browser behavior before the HTML is converted into editor nodes.\n\n## TL;DR\nA flaw in the HTML deserialization routines of @platejs/core prior to 53.3.11 allowed remote attackers to execute arbitrary client-side scripts via unauthenticated user interaction with crafted HTML payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.1 (Medium)\n- **EPSS Score**: N/A\n- **Exploit Status**: PoC (Proof-of-Concept)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @platejs/core\n- **@platejs/core**: < 53.3.11 (Fixed in: `53.3.11`)\n- **@platejs/core**: >= 54.0.0-beta.0 <= 54.0.0-beta.1 (Fixed in: `53.3.11`)\n\n## Mitigation\n\n- Upgrade @platejs/core to version 53.3.11 or above.\n- Apply secondary server-side and client-side sanitization using DOMPurify.\n- Implement a strong Content Security Policy (CSP) to restrict inline script execution.\n\n**Remediation Steps:**\n1. Identify all deployments of udecode/plate in package.json files.\n2. Run 'npm install @platejs/core@53.3.11' or equivalent package manager commands to upgrade the dependencies.\n3. Verify that DOMParser is successfully utilized in built client bundles for HTML deserialization.\n4. Sanitize all rich text data parsed or exported from the editor using a secure library.\n\n## References\n\n- [GitHub Security Advisory (GHSA-qrfj-mgw8-j9c6)](https://github.com/udecode/plate/security/advisories/GHSA-qrfj-mgw8-j9c6)\n- [NVD Record](https://nvd.nist.gov/vuln/detail/CVE-2026-88976)\n- [CVE Org Record](https://www.cve.org/CVERecord?id=CVE-2026-88976)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88976) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T07:31:06.461513Z"}