{"id":"CVE-2026-88976","title":"Plate is a rich-text editor with AI and shadcn/ui","summary":"Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an app…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"udecode","product":"plate","affected":["plate < 53.3.11","plate >= 54.0.0-beta.0, <= 54.0.0-beta.1"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T16:17:20.227","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88976","references":[{"url":"https://github.com/udecode/plate/commit/d02afe45d5ec3a9fb95e0745bc5820ff18a3c12b","label":"security-advisories@github.com"},{"url":"https://github.com/udecode/plate/pull/5117","label":"security-advisories@github.com"},{"url":"https://github.com/udecode/plate/releases/tag/v53.3.11","label":"security-advisories@github.com"},{"url":"https://github.com/udecode/plate/security/advisories/GHSA-qrfj-mgw8-j9c6","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88976"},{"url":"https://github.com/advisories/GHSA-qrfj-mgw8-j9c6"}],"tags":["nvd","cve.org","ghsa","npm"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-16T15:24:04.653416Z"},"ingestedAt":"2026-09-16T14:57:28.063Z","aliases":["GHSA-qrfj-mgw8-j9c6"],"ecosystem":"npm","patched":["@platejs/core 53.3.11"],"epss":0.00253,"epssPercentile":0.17063,"slug":"CVE-2026-88976","body":"## Overview\n\nPlate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs, certain HTML attributes can trigger browser behavior before the HTML is converted into editor nodes. This can allow attacker-controlled script to execute in the consuming application's origin when another user loads the deserialized content. This issue is fixed in version 53.3.11.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-88976)\n\nAffected packages:\n\n- `@platejs/core < 53.3.11`\n- `@platejs/core >= 54.0.0-beta.0, <= 54.0.0-beta.1`\n\nPatched in:\n\n- `@platejs/core 53.3.11`\n\nSource: https://github.com/advisories/GHSA-qrfj-mgw8-j9c6","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}