Intel

AIKIDO-2026-366681

@portabletext/editor is vulnerable to Denial of Service (DoS)

Denial of Service (DoS) Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published 5 days ago

53

Medium Risk

This Affects:

JS@portabletext/editor
4.3.0 - 7.10.8
Fixed in 7.10.9
Are you affected? Scan for Free

TL;DR

The @portabletext/editor package can enter unbounded recursion that overflows the JavaScript call stack and leaves the editor blank until reload. The preventOverlappingAnnotations core behavior raises an annotation.remove followed by the original annotation.add whenever its guard reports the annotation active, but the guard and the remove operation can resolve the effective selection differently, so the remove strips nothing while the guard keeps reporting active and the raise chain never terminates. Concurrent remote patches routinely create the stale or boundary-touching selections that drive this cycle, and a related isActiveAnnotation 'partial' mode flaw reports activity for selections that cover no annotated text. The fix aligns the guard's selection resolution with the remove operation, requires covered text for 'partial' activity, and depth-limits behavior event chains so cycles fail with a console error instead of overflowing the stack.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and the editor processes concurrent or remote patch updates such as those produced by collaborative editing.

Background info

@portabletext/editor is vulnerable to Denial of Service (DoS) in versions 4.3.0 - 7.10.8.

How to fix this

Upgrade the @portabletext/editor library to the patch version.