Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

udecode/plate

              main @ 1cc2497
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Cross-Site Scripting (XSS): 7 prior fixes. Scrutinize any change in this area.

@platejs/media: most-fixed (2 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Insecure handling of media embed sources can allow attackers to render arbitrary content via bypassed protocol schemes within loaded iframes. Failure to block 'javascript:' and other unsafe URI schemes directly exposes users to client-side script execution.

Cross-Site Scripting (XSS): Allowing custom 'isUrl' validators to bypass central URL sanitizers can leave applications vulnerable to malicious 'javascript:' payloads in hyperlinks, as highlighted in CVE-2023-34245. Strict post-validation sanitization must be enforced.

Cross-Site Scripting (XSS): Unchecked mapping of raw Slate elements' attributes to the DOM enables attackers to inject malicious HTML attributes. Explicit allowlisting of safe elements and attribute names is required prior to rendering.