{"id":"GHSA-4882-hxpr-hrvm","summary":"@udecode/plate-link does not sanitize URLs to prevent use of the `javascript:` scheme","details":"### Impact\nAffected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the `javascript:` scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content.\n\n### Patches\n`@udecode/plate-link` 20.0.0 resolves this issue by introducing an `allowedSchemes` option to the link plugin, defaulting to `['http', 'https', 'mailto', 'tel']`. URLs using a scheme that isn't in this list will not be rendered to the DOM.\n\n### Workarounds\nIf you are unable to update `@udecode/plate-link` to version 20.0.0, we recommend overriding the `LinkElement` and `PlateFloatingLink` components with implementations that explicitly check the URL scheme before rendering any anchor elements.\n","aliases":["CVE-2023-34245"],"modified":"2026-09-10T03:50:01.851950637Z","published":"2023-06-09T22:41:56Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2023-06-09T22:41:56Z","nvd_published_at":"2023-06-09T18:15:09Z"},"references":[{"type":"WEB","url":"https://github.com/udecode/plate/security/advisories/GHSA-4882-hxpr-hrvm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34245"},{"type":"WEB","url":"https://github.com/udecode/plate/pull/2240"},{"type":"WEB","url":"https://github.com/udecode/plate/commit/93dd5712854660874900ae12e4d8e6ff28089eb7"},{"type":"PACKAGE","url":"https://github.com/udecode/plate"}],"affected":[{"package":{"name":"@udecode/plate-link","ecosystem":"npm","purl":"pkg:npm/%40udecode/plate-link"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-4882-hxpr-hrvm/GHSA-4882-hxpr-hrvm.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"}]}