GitHub Advisoryadvisory · npm

GHSA-4882-hxpr-hrvm @udecode/plate-link does not sanitize URLs to prevent use of the `javascript:` scheme

HIGH Published 2023-06-09 Modified 2023-06-09 Official page ↗
Aliases
CVE-2023-34245
Ecosystem
npm
Packages
@udecode/plate-link
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-79
Reviewed
2023-06-09

Affected packages

• npm @udecode/plate-link: < 20.0.0 → fixed in 20.0.0

Description

Impact Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the `javascript:` scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content. Patches `@udecode/plate-link` 20.0.0 resolves this issue by introducing an `allowedSchemes` option to the link plugin, defaulting to `['http', 'https', 'mailto', 'tel']`. URLs using a scheme that isn't in this list will not be rendered to the DOM. Workarounds If you are unable to update `@udecode/plate-link` to version 20.0.0, we recommend overriding the `LinkElement` and `PlateFloatingLink` components with implementations that explicitly check the URL scheme before rendering any anchor elements.

Related

Alias · CVE (1)

  • CVE-2023-34245 @udecode/plate-link is the link handler for the udecode/plate rich-text editor plugin system for Slate & React. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References