Beveiligingsadvies

CVE-2026-55596

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-07-08 20:27:58

Laatst bijgewerkt 2026-07-09 13:41:00

Toegewezen door GitHub_M

CVSS-score 8.7

Status PUBLISHED

Beschrijving

Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as a javascript: iframe source that the registry MediaEmbedElement renders directly as an iframe src when a victim opens the document. This issue is fixed in version 53.1.4.

← Alle CVE's bekijken Bekijk op cve.org ↗