CVE-2026-65842 Plate: SSRF with response disclosure in DOCX image embedding
An attacker can trigger server-side requests to internal resources and read responses via DOCX image embedding in the Plate rich-text editor library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-65842?
CVE-2026-65842 is a high-severity server-side request forgery vulnerability in udecode plate, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the fetched image bytes in the generated DOCX, allowing server-side request forgery with response disclosure. Applications can also incur resource consumption from attacker-selected remote responses. This issue is fixed in version 53.3.2.
Weakness: CWE-918
Which versions are affected by CVE-2026-65842?
2 open source packages ship an affected version, including @platejs/docx-io.
| Package | Affected | Fixed in |
|---|---|---|
@platejs/docx-io npm | All versions | 53.3.2 |
@platejs/docx-io npm | All versions | 53.3.2 |
How do I fix CVE-2026-65842?
Upgrade @platejs/docx-io to 53.3.2 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-65842 being exploited?
There is no known exploitation of CVE-2026-65842 in the wild and no public exploit code.
Sources
Also known as GHSA-4q39-2jhr-7qx8.