« Volver al listado

CVE-2026-55596

Estado: AplazadaAlta (8.7)—

Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as a javascript: iframe source that the registry MediaEmbedElement renders directly as an iframe src when a victim opens the document. This issue is fixed in version 53.1.4.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XSS en editor de documentos (CWE-79) mediante iframe con javascript: en metadatos de serialización. UI:R e interacción con documento malicioso confirman T1189 (drive-by). Ejecución JavaScript en navegador (T1059.007) y potencial acceso a sesión/credenciales (T1078).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingRestrict Web-Based ContentApplication Developer GuidanceActive Directory ConfigurationUser Account ManagementPrivileged Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Udecode — PlateAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-55596",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55596",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-09T13:40:39.729677Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "udecode",
          "product": "plate",
          "versions": [
            {
              "status": "affected",
              "version": ">= 53.0.0, < 53.1.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-07-08T21:16:50.247",
  "references": [
    {
      "url": "https://github.com/udecode/plate/commit/6214914ca811adf22d0ad503154494216eed68ba",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/udecode/plate/pull/5014",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/udecode/plate/releases/tag/v53.1.4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as a javascript: iframe source that the registry MediaEmbedElement renders directly as an iframe src when a victim opens the document. This issue is fixed in version 53.1.4."
    }
  ],
  "lastModified": "2026-07-10T19:06:45.623",
  "sourceIdentifier": "security-advisories@github.com"
}