@excalidraw/excalidraw Cross-site Scripting vulnerability

Description

XSS vulnerability due to improperly sanitizing URLs of links that can be attached on canvas elements. This affects users of the npm package @excalidraw/excalidraw provided it was deployed in environments where untrusted user input in drawings that are then shared with third parties is a concern.

Recommendation

Update the @excalidraw/excalidraw package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.15.3
• Patched version(s): 0.15.3

References

• GHSA-v7v8-gjv7-ffmr
• security.snyk.io
• CVE-2023-26140
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• angular-ui-notification Cross-site Scripting vulnerability - CVE-2023-34840
• CKEditor cross-site scripting vulnerability in AJAX sample - CVE-2023-4771
• Joplin Cross-site Scripting vulnerability - CVE-2023-37299
• Scrypted Cross-site Scripting vulnerability - CVE-2023-47623

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

@excalidraw/excalidraw