A remote image URL can be embedded in attacker‑controlled HTML and processed by @platejs/docx-io while converting to DOCX. In a server‑side or privileged environment, the converter performs an HTTP request to the provided URL and includes the retrieved response bytes in the generated document. This enables an attacker to read internal network resources and disclose their content. Additionally, the attacker can select large or slow responses, leading to excessive resource consumption on the vulnerable host. The weakness is a classic SSRF flaw (CWE‑918).

The vulnerability affects the Plate rich‑text editor (udecode:plate) in any version older than v53.3.2. Users deploying Plate for document generation that relies on @platejs/docx-io are at risk when running the conversion on a server or privileged node.

The CVSS score is 8.2, indicating high severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. The attack requires that the vulnerable code runs in a server‑side or privileged context; there is no known client‑side vector. An attacker with control over the input HTML can trigger the conversion, perform the internal request, and retrieve the response, thus achieving internal network information disclosure or denial of service through resource exhaustion.