CVE-2026-65842

@platejs/docx-io, the DOCX import/export package for the Plate.js editor framework, is vulnerable to server-side request forgery with response disclosure (CWE-918) because it fetches remote image URLs while converting HTML to DOCX. An attacker who can inject HTML into a DOCX export function — especially a server-side conversion workflow — can embed image references pointing at attacker-chosen or internal URLs, causing the application's server or privileged environment to issue unintended outbound requests. Because fetched image data is included in the generated document, the attacker can potentially read responses from internal services, network-reachable resources, or cloud metadata endpoints, gaining access to information reachable only from the application's network position. Only applications running @platejs/docx-io versions below 53.3.2 that convert untrusted HTML containing remote image references are affected. No public proof-of-concept or in-the-wild exploitation is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade @platejs/docx-io to version 53.3.2 or later. If an immediate upgrade is not possible, sanitize untrusted HTML to remove remote image references, convert trusted images to data URIs before conversion, or run conversion in an environment with restricted outbound network access. Audit any server-side DOCX export paths to confirm whether user-supplied HTML with remote image URLs reaches the converter, and prioritize fixes for services with access to internal networks or cloud metadata endpoints.