Detections
Analytics

SCA: security update for @udecode/plate-core (GHSA-73rg-f94j-xvhx)

high Tenable Self-Hosted Container Security Plugin ID 411776

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for
 building text editors. One longstanding feature of Plate is the ability to add custom DOM attributes to
 any element or leaf using the `attributes` property. These attributes are passed to the node component
 using the `nodeProps` prop. It has come to our attention that this feature can be used for malicious
 purposes, including cross-site scripting (XSS) and information exposure (specifically, users' IP addresses
 and whether or not they have opened a malicious document). Note that the risk of information exposure via
 attributes is only relevant to applications in which web requests to arbitrary URLs are not ordinarily
 allowed. Plate editors that allow users to embed images from arbitrary URLs, for example, already carry
 the risk of leaking users' IP addresses to third parties. All Plate editors using an affected version of
 @udecode/plate-core are vulnerable to these information exposure attacks via the style attribute and other
 attributes that can cause web requests to be sent. In addition, whether or not a Plate editor is
 vulnerable to cross-site scripting attacks using attributes depends on a number of factors. The most
 likely DOM attributes to be vulnerable are href and src on links and iframes respectively. Any component
 that spreads {...nodeProps} onto an <a> or <iframe> element and does not later override href or src will
 be vulnerable to XSS. In patched versions of Plate, we have disabled element.attributes and
 leaf.attributes for most attribute names by default, with some exceptions including target, alt, width,
 height, colspan and rowspan on the link, image, video, table cell and table header cell plugins. If this
 is a breaking change for you, you can selectively re-enable attributes for certain plugins as follows.
 Please carefully research and assess the security implications of any attribute you allow, as even
 seemingly innocuous attributes such as style can be used maliciously. If you are unable to upgrade to any
 of the patched versions, you should use a tool like patch-package or yarn patch to remove the logic from
 @udecode/plate-core that adds attributes to nodeProps. (CVE-2024-47061)

See Also

https://github.com/advisories/GHSA-73rg-f94j-xvhx

Plugin Details

Severity: High

ID: 411776

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

Percentile: 57.08

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 8.7

Temporal Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:P

CVSS Score Source: CVE-2024-47061

CVSS v3

Risk Factor: High

Base Score: 8.3

Temporal Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/20/2024

Vulnerability Publication Date: 9/20/2024

Reference Information

CVE: CVE-2024-47061

cwe: CWE-79