https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T18:23:11.875401+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-209186 EUVD-2026-209186 2026-10-12T18:23:11.945368+00:00 EUVD-2026-209186 https://cve.radiocsirt.org/vuln/fkie_cve-2023-34245 fkie_cve-2023-34245 2026-10-12T18:23:11.945403+00:00

@udecode/plate-link is the link handler for the udecode/plate rich-text editor plugin system for Slate & React. Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the `javascript:` scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content. `@udecode/plate-link` 20.0.0 resolves this issue by introducing an `allowedSchemes` option to the link plugin, defaulting to `['http', 'https', 'mailto', 'tel']`. URLs using a scheme that isn't in this list will not be rendered to the DOM. Users are advised to upgrade. Users unable to upgrade are advised to override the `LinkElement` and `PlateFloatingLink` components with implementations that explicitly check the URL scheme before rendering any anchor elements.

 https://cve.radiocsirt.org/vuln/ghsa-4882-hxpr-hrvm GHSA-4882-hxpr-hrvm — @udecode/plate-link does not sanitize URLs to prevent use of the `javascript:` scheme 2026-10-12T18:23:11.945441+00:00

Affected: npm: @udecode/plate-link

### Impact Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the `javascript:` scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content.

### Patches `@udecode/plate-link` 20.0.0 resolves this issue by introducing an `allowedSchemes` option to the link plugin, defaulting to `['http', 'https', 'mailto', 'tel']`. URLs using a scheme that isn't in this list will not be rendered to the DOM.

### Workarounds If you are unable to update `@udecode/plate-link` to version 20.0.0, we recommend overriding the `LinkElement` and `PlateFloatingLink` components with implementations that explicitly check the URL scheme before rendering any anchor elements.

 https://cve.radiocsirt.org/vuln/gsd-2023-34245 gsd-2023-34245 2026-10-12T18:23:11.945473+00:00 gsd-2023-34245