무슨 일이 있었나
2026-08-20에 발표된 (CVSS 8.2, 높음), 이 SSRF 취약점은 Plate의 docx-io 변환 라이브러리에 의해 처
왜 중요한가
Plate markets itself explicitly as an AI-integrated editor; content passed through AI generation/completion features and then exported server-side to DOCX can carry attacker-influenced image URLs, making this a concrete AI-content-to-SSRF pipeline risk for document-generation features in AI writing assistants.
공격 경로
htmlToDocxBlob fetches remote image URLs embedded in attacker-controlled HTML during server-side or privileged DOCX conversion, allowing the converter to make requests to internal network resources and include the fetched response in the generated document.
영향받는 시스템
@platejs/docx-io prior to Plate 53.3.2
완화 방안
Upgrade to Plate ≥53.3.2; restrict or allowlist outbound image-fetch destinations during server-side document conversion.