Potential SSRF Vulnerability in @platejs/docx-io npm Package
- Severity
- HIGH
- Affected component
- @platejs/docx-io (npm)
- Affected versions
- < 53.3.2
- Patched version
- 53.3.2
An early warning has been issued regarding a potential SSRF vulnerability in the @platejs/docx-io npm package. This vulnerability could allow unintended outbound requests and response disclosure when converting HTML to DOCX in a server-side or privileged environment.
What happened
The @platejs/docx-io npm package, when converting HTML to DOCX, can fetch remote image URLs. This functionality, if exploited, could lead to the application environment making unintended outbound requests and including fetched image data in the generated DOCX. This is particularly concerning in server-side or privileged environments where attacker-controlled HTML is processed.
The vulnerability is under investigation and has been tracked under the ID GHSA-4Q39-2JHR-7QX8. It was first flagged on 2026-09-02T22:14:54+00:00. The @platejs/docx-io package versions prior to 53.3.2 are reportedly affected.
What to do about it
- Upgrade to @platejs/docx-io version 53.3.2 or later to mitigate the risk.
- Review your application's usage of the @platejs/docx-io package to ensure it is not processing untrusted HTML in a server-side or privileged environment.
- Monitor the primary sources for updates on this vulnerability.
How 0Day would have caught this
@platejs/docx-io is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If your application uses the @platejs/docx-io npm package in versions prior to 53.3.2, you may be affected.
What should I do right now?
Upgrade to @platejs/docx-io version 53.3.2 or later as soon as possible.
Is this vulnerability being actively exploited?
There is no confirmed evidence of this vulnerability being exploited in the wild at this time.