Udecode vulnerabilities
We track 4 vulnerabilities in Udecode products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 20, 2026.
Latest Udecode vulnerabilities
- 8.2 High severity
plate: Server-Side Request Forgery
Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to inter
- 8.7 High severity
plate: Improper Neutralization of Input During Web Page Generation
Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a know
- 8.3 High severity
plate: Improper Neutralization of Input During Web Page Generation
Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the `attributes` propert
- 8.1 High severity
plate: Improper Neutralization of Input During Web Page Generation
Plate media is an open source, rich-text editor for React. Editors that use `MediaEmbedElement` and pass custom `urlParsers` to the `useMediaState` hook may be vulnerable to XSS if a custom parser allows `javascript:`, `data:` or `vbscript:` URLs to be embedde