CyberRota Analysis
AI-GeneratedThe vulnerability affects the Plate rich-text editor, specifically the @platejs/docx-io component, which improperly fetches remote image URLs from attacker-controlled HTML in versions prior to 53.3.2. This flaw allows for server-side request forgery (SSRF) and potential disclosure of internal network resources, as well as resource exhaustion from malicious responses. Organizations utilizing this editor should prioritize updating to version 53.3.2 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the fetched image bytes in the generated DOCX, allowing server-side request forgery with response disclosure. Applications can also incur resource consumption from attacker-selected remote responses. This issue is fixed in version 53.3.2.