CVE-2026-88976

Name of the Vulnerable Software and Affected Versions Plate versions prior to 53.3.11 Plate versions 54.0.0-beta.0 through 54.0.0-beta.1

Description Core HTML deserialization APIs parse supplied HTML strings within the active document. When untrusted or cross-user HTML is passed to these APIs, specific HTML attributes can trigger browser behavior before the content is converted into editor nodes. This allows an attacker to execute arbitrary script in the application origin when a user loads the deserialized content.

Recommendations Update to version 53.3.11 or later. Install the fixed stable line. Sanitize untrusted HTML before rendering it.