This vulnerability (CVE-2026-65842) poses a significant risk for environments where internal network resources are accessible to the server running the conversion. Because the library embeds the fetched image data into the generated DOCX file, an attacker can leverage this mechanism to exfiltrate data from otherwise unreachable internal services or probe for open ports and services, resulting in a server-side response disclosure. Defenders should ensure all input is sanitized or processed in a network-isolated environment.

Impact

The vulnerability affects applications that utilize @platejs/docx-io to convert untrusted HTML into DOCX files, particularly in server-side workflows. Successful exploitation enables unauthorized internal network probing and potential leakage of sensitive internal data into the exported document. All users are urged to upgrade to version 53.3.2 or later to mitigate the risk.

Recommendation

• Upgrade the @platejs/docx-io package to version 53.3.2 or later immediately to patch CVE-2026-65842.
• Implement strict input sanitization on all user-supplied HTML before it reaches the conversion engine to strip remote image source references.
• Convert any necessary remote images into Base64-encoded Data URIs within the application layer prior to calling the library for DOCX conversion.
• Isolate the conversion process within a sandboxed environment or a container with egress-restricted network access to prevent unauthorized outbound requests.