high · 8.2CVE-2026-65842Sep 2, 2026

CVE-2026-65842: @platejs/docx-io Server-Side Request Forgery via Remote Image Fetch

Shubham Kandhare
Security Engagement Manager, SecureLayer7

When @platejs/docx-io converts attacker-controlled HTML to DOCX, it unconditionally fetches any remote image URL found in the markup, letting an attacker pivot the server into probing internal…

Package@platejs/docx-io
Ecosystemnpm
Affected< 53.3.2
Fixed in53.3.2
CVE-2026-65842: @platejs/docx-io Server-Side Request Forgery via Remote Image Fetch

The problem

The htmlToDocxBlob function in @platejs/docx-io resolves and fetches every <img src> URL it encounters before embedding the image data into the generated DOCX file. There is no allowlist, no scheme check, and no restriction on private or link-local addresses.

In any server-side workflow where untrusted HTML is passed to this function, an attacker can supply arbitrary URLs. This includes internal services, cloud metadata endpoints such as http://169.254.169.254/, and other non-routable addresses that are reachable only from the server.

The fetched response bytes are embedded in the DOCX output, giving the attacker both network-level reach and potential response disclosure.

Proof of concept

A working proof-of-concept for CVE-2026-65842 in @platejs/docx-io, with the exact payload below.

javascript
<img src="http://169.254.169.254/latest/meta-data/iam/security-credentials/" />

<!-- Embed the above HTML as the input to htmlToDocxBlob on the server: -->
import { htmlToDocxBlob } from '@platejs/docx-io';

// attacker controls the `html` string
const html = '<img src="http://169.254.169.254/latest/meta-data/iam/security-credentials/" />';
const blob = await htmlToDocxBlob(html); // server fetches the metadata URL and embeds response bytes into DOCX

Before the patch, htmlToDocxBlob iterated over all <img> elements and fetched each src URL using a standard HTTP client running in the server process. No URL scheme or destination validation was performed, so http://, https://, and any reachable address were accepted equally.

The patch in PR #5053 (commit 21aa59926) changed the default behavior to skip remote URLs entirely. Callers who need remote images must now explicitly pass allowRemoteImages: true, and should only do so when the HTML source is fully trusted. This is a classic CWE-918 pattern: user-controlled input is passed directly to a server-side HTTP fetch without restriction.

The fix

Upgrade @platejs/docx-io to version 53.3.2 or later. After upgrading, remote image URLs are skipped by default. If your application legitimately needs to embed remote images, pre-convert them to base64 data URIs before calling htmlToDocxBlob, or pass allowRemoteImages: true only when the HTML comes from a fully trusted source.

As a network-level defense-in-depth measure, run DOCX conversion in an environment with egress restrictions that block access to internal RFC-1918 ranges and link-local addresses.

Reported by EQSTLab.

References: [1][2][3][4][5][6]

Related research