Skip to content
OpenAdvisories

Package · npm

@platejs/docx-io

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 8.2
    CVE-2026-65842

    Plate: SSRF with response disclosure in DOCX image embedding

    Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to inte…

    udecode plate @platejs/docx-io npm