CVE-2026-88976: HTML Deserialization Cross-Site Scripting in @platejs/core

Vulnerability ID: CVE-2026-88976
CVSS Score: 6.1
Published: 2026-09-17

Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs, certain HTML attributes can trigger browser behavior before the HTML is converted into editor nodes.

TL;DR

A flaw in the HTML deserialization routines of @platejs/core prior to 53.3.11 allowed remote attackers to execute arbitrary client-side scripts via unauthenticated user interaction with crafted HTML payloads.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-79
• Attack Vector: Network (AV:N)
• CVSS Score: 6.1 (Medium)
• EPSS Score: N/A
• Exploit Status: PoC (Proof-of-Concept)
• KEV Status: Not Listed

Affected Systems

• @platejs/core
• @platejs/core: < 53.3.11 (Fixed in: 53.3.11)
• @platejs/core: >= 54.0.0-beta.0 <= 54.0.0-beta.1 (Fixed in: 53.3.11)

Code Analysis

Commit: d02afe4

Fix HTML deserialization XSS

Mitigation Strategies

• Upgrade @platejs/core to version 53.3.11 or above.
• Apply secondary server-side and client-side sanitization using DOMPurify.
• Implement a strong Content Security Policy (CSP) to restrict inline script execution.

Remediation Steps:

1. Identify all deployments of udecode/plate in package.json files.
2. Run 'npm install @platejs/[email protected]' or equivalent package manager commands to upgrade the dependencies.
3. Verify that DOMParser is successfully utilized in built client bundles for HTML deserialization.
4. Sanitize all rich text data parsed or exported from the editor using a secure library.

References

• GitHub Security Advisory (GHSA-qrfj-mgw8-j9c6)
• NVD Record
• CVE Org Record

Read the full report for CVE-2026-88976 on our website for more details including interactive diagrams and full exploit analysis.