CVE-2026-55596: Plate Rich-Text Editor XSS Vulnerability

CVE-2026-55596 Overview

CVE-2026-55596 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Plate, a rich-text editor built with AI and shadcn/ui. Versions from 53.0.0 up to (but not including) 53.1.4 fail to validate URL protocols in the media embed renderer. The useMediaState hook trusts serialized provider or sourceUrl metadata within a Plate document and bypasses the parseMediaUrl protocol validation step. An attacker can craft a document that declares a legitimate video provider while smuggling a javascript: URI into the url field, which the MediaEmbedElement then renders as an iframe src.

Critical Impact

Opening a malicious Plate document executes attacker-controlled JavaScript in the victim's browser context, enabling session theft, account takeover, and data exfiltration.

Affected Products

• Plate >= 53.0.0 and < 53.1.4
• Applications embedding the @udecode/plate media package
• Web editors relying on the registry MediaEmbedElement renderer

Discovery Timeline

• 2026-07-08 - CVE-2026-55596 published to NVD
• 2026-07-08 - Last updated in NVD database
• v53.1.4 - Fix released by the Plate maintainers on GitHub

Technical Details for CVE-2026-55596

Vulnerability Analysis

The flaw lives in packages/media/src/react/media/useMediaState.ts. When a Plate element contains either a provider or sourceUrl property, the hook short-circuits and returns an embed object without invoking parseMediaUrl. That parser is the component responsible for enforcing an allow-list of URL schemes such as https:. Skipping it means any string in element.url propagates directly to the iframe renderer.

Because Plate documents are typically stored server-side or shared between users, this is a stored XSS condition. A victim only needs to open a shared document for the payload to execute. The Same-Origin execution context grants the payload access to cookies, local storage, and any authenticated APIs the host application exposes.

Root Cause

The root cause is trust in serialized document metadata. The code assumed that if a provider field existed, the accompanying url had already been validated at ingestion time. No secondary check enforced this assumption, so an attacker who controls the JSON representation of a media node can pair a trusted provider label with a javascript: URL.

Attack Vector

Exploitation requires an authenticated user (PR:L) to open or render a crafted document (UI:R). Because the payload escapes the media component sandbox and executes in the host page origin, the scope changes (S:C), impacting confidentiality and integrity of the surrounding application.

// Patched code from packages/media/src/react/media/useMediaState.ts
// The vulnerable early-return that trusted element.provider/sourceUrl was removed.
    )
      return;

-    if (element.provider || element.sourceUrl) {
-      return {
-        id: element.id,
-        provider: element.provider,
-        sourceUrl: element.sourceUrl,
-        url,
-      };
-    }
-
    return parseMediaUrl(url, { urlParsers });
    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [element.id, element.provider, element.sourceUrl, urlParsers, url]);
+  }, [urlParsers, url]);

  const isTweet = embed?.provider === 'twitter';
  const isVideo = !!embed?.provider && VIDEO_PROVIDERS.includes(embed.provider);

Source: GitHub Commit 6214914

Detection Methods for CVE-2026-55596

Indicators of Compromise

• Plate document JSON containing a media element with a recognized provider (for example youtube, vimeo, twitter) paired with a url beginning with javascript:, data:, or vbscript:.
• Rendered iframes in the DOM whose src attribute starts with javascript: inside a MediaEmbedElement.
• Content Security Policy (CSP) violation reports referencing inline script execution from editor pages.

Detection Strategies

• Scan stored Plate documents at rest for media nodes whose url field does not match an https:// scheme.
• Add server-side validation that re-runs parseMediaUrl on submission and rejects documents failing the scheme allow-list.
• Instrument the front end to log or block iframe insertions with non-HTTP protocols.

Monitoring Recommendations

• Monitor application logs for anomalous document uploads containing the string javascript: inside media metadata.
• Enforce and alert on CSP frame-src and script-src violations from editor routes.
• Track dependency versions of @udecode/plate-media in software composition analysis (SCA) tooling and flag any release below 53.1.4.

How to Mitigate CVE-2026-55596

Immediate Actions Required

• Upgrade @udecode/plate and the media subpackage to version 53.1.4 or later.
• Audit existing stored documents for media nodes containing non-HTTPS URLs and purge or rewrite them.
• Rotate session tokens for users who may have opened untrusted Plate documents during the vulnerable window.

Patch Information

The fix is available in GitHub Release v53.1.4 and merged via Pull Request 5014. Full technical context is provided in GitHub Security Advisory GHSA-qj6x-xx2h-8hvv. The patch removes the early return that trusted serialized provider and sourceUrl metadata, forcing every URL through parseMediaUrl protocol validation.

Workarounds

• Deploy a strict Content Security Policy that disallows javascript: URIs in frame-src and inline script execution.
• Sanitize inbound Plate JSON on the server, stripping any media node whose url scheme is not https:.
• Restrict document sharing to trusted users until the upgrade is deployed.

# Update to the patched release
npm install @udecode/plate@^53.1.4

# Or with pnpm / yarn
pnpm add @udecode/plate@^53.1.4
yarn add @udecode/plate@^53.1.4