Cross-Site Scripting Vulnerability in Plate Media Embed Renderer

The Plate media embed component, specifically the @platejs/media package (versions 53.0.0 through 53.1.3), contains a critical flaw that allows for Stored Cross-Site Scripting (XSS). The vulnerability exists because the library's useMediaState hook contains a fast-path optimization that incorrectly trusts serialized document metadata (provider, sourceUrl, and id) without re-validating the url parameter.

By crafting a Plate document that specifies a legitimate video provider (e.g., vimeo) but provides an arbitrary url field containing javascript: URIs, an attacker can bypass the intended parseMediaUrl sanitization logic. When a victim opens a document containing this malicious node, the registry MediaEmbedElement trusts the attacker-supplied provider metadata and proceeds to render the malicious url directly into an <iframe> src attribute. This results in the execution of JavaScript within the context of the host application, potentially leading to session hijacking or sensitive data exfiltration.

Impact

Successful exploitation allows for arbitrary JavaScript execution in the victim's browser context. The impact is dependent on the host application's session model and document access permissions. In collaborative environments, this could lead to widespread XSS against users who view maliciously crafted documents. The vulnerability is addressed in @platejs/media version 53.1.4.

Recommendation

1. Upgrade the @platejs/media package to version 53.1.4 or later immediately.
2. Implement strict input validation on the client side to ensure the url field in media embeds uses only http: or https: protocols.
3. Treat all serialized metadata, including provider, sourceUrl, and id, as untrusted; always recompute these values from the url field using parseMediaUrl rather than relying on cached serialized data.