Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the fetched image bytes in the generated DOCX, allowing server-side request forgery with response disclosure. Applications can also incur resource consumption from attacker-selected remote responses. This issue is fixed in version 53.3.2.

A server-side request forgery (SSRF) vulnerability exists in the @platejs/docx-io package of the Plate rich-text editor prior to version 53.3.2. The vulnerability arises when the htmlToDocxBlob function processes attacker-controlled HTML containing remote image URLs in a server-side or privileged environment. The converter fetches these remote URLs without adequate restrictions, enabling attackers to make requests to internal network resources. Fetched image bytes are embedded in the generated DOCX file, resulting in response disclosure of internal data. Additionally, attackers can cause resource exhaustion by directing the server to fetch large or slow remote responses. The issue has been patched in version 53.3.2 of the Plate library.