Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @platejs/core | npm | < 53.3.11 | 53.3.11 |
| @platejs/core | npm | >= 54.0.0-beta.0, <= 54.0.0-beta.1 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-88976, describes how HTML deserialization in @platejs/core could lead to browser behavior during parsing due to HTML strings being processed in the active document. This could allow an attacker to execute script in another user's browser. The provided commit d02afe45d5ec3a9fb95e0745bc5820ff18a3c12b (and its equivalent b8082a1585a105f28a648dfd79e4d2878ae8a588) directly addresses this issue.
Upon analyzing the patch, two key functions were identified as being modified to fix this vulnerability:
htmlStringToDOMNode: In its vulnerable state, this function created a <body> element using document.createElement('body') and then set its innerHTML property to the raw HTML string. This operation causes the browser to parse the HTML directly within the active document, making it susceptible to side effects from attributes like onload, onerror, or other script-executing attributes.
getEditorDOMFromHtmlString: Similarly, this function also created a <body> element in the active document and assigned the input HTML to its innerHTML. This method of parsing HTML in the active DOM is the root cause of the vulnerability.
The fix for both functions involves changing the HTML parsing mechanism to use an 'inert' document. For htmlStringToDOMNode, it now delegates to a parseHtmlDocument utility. For getEditorDOMFromHtmlString, it directly uses new DOMParser().parseFromString(html, 'text/html'). Both of these methods ensure that the HTML is parsed in a separate, non-active document context, preventing unintended browser behaviors or script execution during the parsing phase. Therefore, the original implementations of these two functions are the vulnerable components.
htmlStringToDOMNodepackages/core/src/lib/plugins/html/utils/htmlStringToDOMNode.ts
getEditorDOMFromHtmlStringpackages/core/src/static/deserialize/htmlStringToEditorDOM.ts