@excalidraw/excalidraw Cross-site Scripting vulnerability

Description

XSS vulnerability due to improperly sanitizing URLs of links that can be attached on canvas elements. This affects users of the npm package @excalidraw/excalidraw provided it was deployed in environments where untrusted user input in drawings that are then shared with third parties is a concern.

Recommendation

Update the @excalidraw/excalidraw package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.15.3
• Patched version(s): 0.15.3

References

• GHSA-v7v8-gjv7-ffmr
• security.snyk.io
• CVE-2023-26140
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Finance.js vulnerable to DoS via the seekZero() parameter - CVE-2025-56572
• Stored Cross-site Scripting (XSS) in excalidraw's web embed component - CVE-2024-32472
• Stimulsoft Dashboard.JS directory traversal vulnerability - CVE-2024-24398
• Inefficient Regular Expression Complexity in handsontable - CVE-2021-23446

Tags:

npm

@excalidraw/excalidraw