high · 8.7CVE-2026-55596Aug 25, 2026

CVE-2026-55596: @platejs/media Media Embed Stored XSS via Serialized Provider Metadata

Rohit Hatagale
AI Security Researcher, SecureLayer7

A crafted Plate document can smuggle a javascript: URL into a media embed iframe by setting a trusted provider name in serialized node metadata, bypassing the URL sanitization that normally blocks…

Package@platejs/media
Ecosystemnpm
Affected>= 53.0.0, < 53.1.4
Fixed in53.1.4
CVE-2026-55596: @platejs/media Media Embed Stored XSS via Serialized Provider Metadata

The problem

The useMediaState hook in @platejs/media had a fast path: if a document node already contained provider or sourceUrl fields, it returned those values directly without calling parseMediaUrl or running any protocol check.

Because provider is plain document data, an attacker who can share or store a Plate document can set provider to vimeo while setting url to javascript:.... The registry MediaEmbedElement sees a recognized video provider and renders <iframe src={embed.url}>, executing the attacker payload in the victim's browser context.

Session data and in-page actions are exposed depending on the host application.

Proof of concept

A working proof-of-concept for CVE-2026-55596 in @platejs/media, with the exact payload below.

json
{
  "type": "media_embed",
  "provider": "vimeo",
  "sourceUrl": "https://vimeo.com/1",
  "url": "javascript:parent.postMessage('plate-media-xss','*')",
  "children": [{ "text": "" }]
}

The root cause is that useMediaState trusted serialized provider and sourceUrl as proof that the URL had already been parsed and validated. It had not. parseMediaUrl enforces an http:/https: allowlist, but that function was never called on the fast-path branch.

The patch (v53.1.4, commit 6214914) removes the fast path entirely. Embed metadata is now always recomputed from the live url field via parseMediaUrl, so the protocol allowlist is applied on every render regardless of what the stored node claims. CWE-79 (Improper Neutralization of Input During Web Page Generation).

The fix

Upgrade @platejs/media to **53.1.4** or later. The fix recomputes embed metadata from url through parseMediaUrl on every render, discarding any serialized provider, id, or sourceUrl values as authoritative. Treat all three fields in stored documents as untrusted derived data going forward.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research