CVE-2026-88976: @platejs/core HTML deserialization can trigger browser behavior during parsing

September 17, 2026

HTML strings passed to Plate’s core deserialization APIs were parsed in the active document. Certain HTML attributes could therefore trigger browser behavior during parsing, before the content was converted into editor nodes.

Applications that deserialize HTML from untrusted or cross-user sources may be affected.

References

github.com/advisories/GHSA-qrfj-mgw8-j9c6
github.com/udecode/plate/commit/d02afe45d5ec3a9fb95e0745bc5820ff18a3c12b
github.com/udecode/plate/pull/5117
github.com/udecode/plate/releases/tag/v53.3.11
github.com/udecode/plate/security/advisories/GHSA-qrfj-mgw8-j9c6
nvd.nist.gov/vuln/detail/CVE-2026-88976

Code Behaviors & Features

Detect and mitigate CVE-2026-88976 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →