CVE-2026-65842
Received Received - Intake

Remote Image Fetch SSRF in Plate Editor via @platejs/docx-io

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the fetched image bytes in the generated DOCX, allowing server-side request forgery with response disclosure. Applications can also incur resource consumption from attacker-selected remote responses. This issue is fixed in version 53.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-65842
EUVD
EUVD-2026-63471

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
platejs plate to 53.3.2 (exc)
platejs docx_io to 53.3.2 (exc)
udecode plate to 53.3.2 (exc)
udecode @platejs_docx_io to 53.1.0 (exc)
udecode @platejs_docx_io 53.3.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65842 is a Server-Side Request Forgery (SSRF) vulnerability in the @platejs/docx-io package. It allows attackers to make unintended outbound requests to internal network resources during HTML to DOCX conversion. The converter fetches remote image URLs from attacker-controlled HTML and includes the fetched data in the generated DOCX file, enabling response disclosure and resource consumption attacks.

Detection Guidance

This vulnerability involves unsafe remote image fetching during DOCX export in @platejs/docx-io. Detection requires checking if your application processes untrusted HTML with remote image URLs and uses affected versions (<53.3.2). Inspect network logs for unexpected outbound requests during document conversion.

Impact Analysis

This vulnerability can expose internal network resources to attackers, leading to data leaks or unauthorized access. It may also cause resource exhaustion by processing large or malicious remote responses. Systems processing untrusted HTML with remote images are at risk, especially in server-side environments.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or disclosure. GDPR may be impacted due to potential data leaks, while HIPAA could be compromised if protected health information is exposed through SSRF. Organizations must mitigate this risk to maintain regulatory compliance.

Mitigation Strategies

Upgrade to @platejs/docx-io version 53.3.2 or later. Avoid processing untrusted HTML with remote image URLs. Sanitize HTML to remove remote image references or convert trusted images to data URIs. Restrict network access during conversion if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65842. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart