{"id":"CVE-2024-40631","aliases":["GHSA-h3pq-667x-r789"],"url":"https://o3.security/vulnerability/CVE-2024-40631","summary":"Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media","details":"### Impact\nEditors that use `MediaEmbedElement` and pass custom `urlParsers` to the `useMediaState` hook may be vulnerable to XSS if a custom parser allows `javascript:`, `data:` or `vbscript:` URLs to be embedded. Editors that do not use `urlParsers` and instead consume the `url` property directly may also be vulnerable if the URL is not sanitised.\n\nThe default parsers `parseTwitterUrl` and `parseVideoUrl` are not affected.\n\nExamples of vulnerable code:\n\n```tsx\nconst { embed } = useMediaState({\n  urlParsers: [\n    // Custom parser that does not use an allowlist or validate the URL protocol\n    (url) => ({ url }),\n  ],\n});\n\nreturn (\n  <iframe\n    src={embed!.url}\n    // ...\n  />\n);\n```\n\n```tsx\nconst { url } = useMediaState();\n\nreturn (\n  <iframe\n    // url property used directly from useMediaState() with no sanitisation\n    src={url}\n    // ...\n  />\n);\n```\n\n\n```tsx\nconst { url } = element;\n\nreturn (\n  <iframe\n    // url property used directly from element with no sanitisation\n    src={url}\n    // ...\n  />\n);\n```\n\n### Patches\n`@udecode/plate-media` 36.0.10 resolves this issue by only allowing HTTP and HTTPS URLs during parsing. This affects only the `embed` property returned from `useMediaState`.\n\nIn addition, the `url` property returned from `useMediaState` has been renamed to `unsafeUrl` to indicate that it has not been sanitised. The `url` property on `element` is also unsafe, but has not been renamed. If you're using either of these properties directly, you will still need to validate the URL yourself.\n\n### Workarounds\nEnsure that any custom `urlParsers` do not allow `javascript:`, `data:` or `vbscript:` URLs to be returned in the `url` property of their return values.\n\nIf `url` is consumed directly, validate the URL protocol before passing it to the `iframe` element.\n\n### References\nHow to verify the protocol of a URL: https://stackoverflow.com/a/43467144","published":"2024-07-15T18:21:16.323Z","modified":"2026-09-20T11:30:13.817632871Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"epss":{"score":0.00498,"percentile":0.40627,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@udecode/plate-media","fixedVersion":"36.0.10"}],"fix":{"url":"https://github.com/udecode/plate/commit/1bc0971774fbfb770780c9bdb94746a6f0f196a0","label":"udecode/plate@1bc0971"},"references":[{"type":"WEB","url":"https://stackoverflow.com/a/43467144"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40631.json"},{"type":"ADVISORY","url":"https://github.com/udecode/plate/security/advisories/GHSA-h3pq-667x-r789"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40631"},{"type":"FIX","url":"https://github.com/udecode/plate/commit/1bc0971774fbfb770780c9bdb94746a6f0f196a0"},{"type":"PACKAGE","url":"https://github.com/udecode/plate"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-20T11:30:13.817632871Z"}}