Udecode Plate
6 CVEs affecting Udecode Plate. Latest disclosed: 2026-09-16. Critical: 0, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-55596 | High | 8.7 | 2026-07-08 | Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMe… |
CVE-2024-47061 | High | 8.3 | 2024-09-20 | Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longstanding feature of Pl… |
CVE-2026-65842 | High | 8.2 | 2026-08-20 | Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML throug… |
CVE-2024-40631 | High | 8.1 | 2024-07-15 | Plate media is an open source, rich-text editor for React. Editors that use `MediaEmbedElement` and pass custom `urlParsers` to the `useMediaState` hook may be… |
CVE-2023-34245 | High | 8.1 | 2023-06-09 | @udecode/plate-link is the link handler for the udecode/plate rich-text editor plugin system for Slate & React. Affected versions of the link plugin and link U… |
CVE-2026-88976 | Medium | 6.1 | 2026-09-16 | Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deseri… |