udecode plate

• CVE-2026-88976 Medium 6.1 @platejs/core HTML deserialization can trigger browser behavior during parsing 0.3%
• CVE-2026-65842 High 8.2 Plate: SSRF with response disclosure in DOCX image embedding 0.5%
• CVE-2026-55596 High 8.7 Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript 0.3%
• CVE-2024-47061 High 8.3 Arbitrary DOM attributes in element.attributes and leaf.attributes in Platejs 0.5%
• CVE-2024-40631 High 8.1 Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media 0.5%
• CVE-2023-34245 High 8.1 Cross site scripting (XSS) in @udecode/plate-link 0.4%