CVE-2024-47061 Overview
CVE-2024-47061 affects Plate, a JavaScript toolkit built on top of Slate for developing rich text editors. The vulnerability resides in the @udecode/plate-core package, where the attributes property on elements and leaves is passed to node components through the nodeProps prop. Attackers can abuse this mechanism to inject malicious DOM attributes, leading to cross-site scripting (XSS) and information exposure such as leaking users' IP addresses. The flaw is tracked under [CWE-79] and carries an EPSS score of 0.515%.
Critical Impact
Malicious documents can execute arbitrary JavaScript in the browser and leak users' IP addresses through attributes that trigger outbound web requests.
Affected Products
- @udecode/plate-core (pre-patched versions)
- Plate editors spreading {...nodeProps} onto <a> or <iframe> elements without overriding href or src
- Any Plate editor rendering user-controlled element.attributes or leaf.attributes
Discovery Timeline
- 2024-09-20 - CVE-2024-47061 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-47061
Vulnerability Analysis
Plate historically supported a feature that permitted authors of document content to attach arbitrary DOM attributes to any element or leaf node. The toolkit forwards these attributes to the rendered React component through the nodeProps prop. Downstream components then spread nodeProps onto native DOM elements, causing user-controlled attribute values to reach the browser without sanitization. Attackers craft documents that carry attributes such as href, src, or style to trigger script execution or force the browser to issue outbound web requests.
Root Cause
The root cause is missing input validation on element.attributes and leaf.attributes inside @udecode/plate-core. The library trusts document authors and forwards attribute maps directly into component props. When a component spreads {...nodeProps} onto elements like <a> or <iframe> and does not later override href or src, the attacker-controlled values take effect. Even a style attribute can be weaponized to embed url(...) references that leak the viewer's IP address.
Attack Vector
An authenticated attacker with the ability to author or share a Plate document embeds malicious attribute values inside the document JSON. When a victim opens the document, the browser evaluates the attacker's href, src, or style attributes. This yields JavaScript execution when the attribute targets a scriptable sink such as javascript: URIs on <a> tags or src on <iframe>. When the attribute triggers a network fetch, it exposes the viewer's IP address and confirms document access to the attacker's server.
The vulnerability manifests when node components spread the nodeProps prop onto DOM elements without overriding security-sensitive attributes. See the GitHub Security Advisory for technical details.
Detection Methods for CVE-2024-47061
Indicators of Compromise
- Plate document JSON containing unexpected attribute keys such as href, src, style, formaction, or event handlers on element or leaf nodes.
- Outbound HTTP requests from client browsers to unfamiliar third-party domains immediately after opening a document.
- Log entries showing users loading resources from attacker-controlled hosts referenced only inside document attributes fields.
Detection Strategies
- Audit stored Plate documents for attributes properties containing keys outside the default allowlist (target, alt, width, height, colspan, rowspan).
- Deploy a strict Content Security Policy (CSP) and monitor report-uri violations for unexpected script and image sources originating from document renders.
- Instrument the application to log any attribute spread onto <a>, <iframe>, <img>, or <video> elements that resolves to non-allowlisted origins.
Monitoring Recommendations
- Track dependency manifests for @udecode/plate-core versions and alert when unpatched releases are detected in CI or production builds.
- Monitor browser telemetry for anomalous outbound requests correlated with document viewing sessions.
- Enable CSP violation reporting to identify inline scripts or forbidden URI schemes injected through document attributes.
How to Mitigate CVE-2024-47061
Immediate Actions Required
- Upgrade @udecode/plate-core and dependent Plate plugin packages to the patched versions listed in the GitHub Security Advisory.
- Audit custom node components that spread {...nodeProps} and explicitly override href, src, and style after the spread.
- Sanitize stored document JSON to remove attribute keys that are not required by the application.
Patch Information
Patched versions of Plate disable element.attributes and leaf.attributes for most attribute names by default. A short allowlist remains enabled for the link, image, video, table cell, and table header cell plugins covering target, alt, width, height, colspan, and rowspan. Applications requiring additional attributes must selectively re-enable them per plugin after evaluating the security implications, including the risk that attributes such as style still permit information exposure.
Workarounds
- If upgrading is not possible, use patch-package or yarn patch to strip the logic in @udecode/plate-core that copies attributes into nodeProps.
- Enforce a Content Security Policy that blocks inline scripts, javascript: URIs, and untrusted image or frame sources.
- Post-process document JSON on the server side to reject or drop attribute keys outside a strict allowlist before delivering documents to viewers.
# Configuration example
npm install @udecode/plate-core@latest
# Or apply a local patch if upgrading is blocked
npx patch-package @udecode/plate-core
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
