@excalidraw/excalidraw Cross-site Scripting vulnerability

Description

XSS vulnerability due to improperly sanitizing URLs of links that can be attached on canvas elements. This affects users of the npm package @excalidraw/excalidraw provided it was deployed in environments where untrusted user input in drawings that are then shared with third parties is a concern.

Recommendation

Update the @excalidraw/excalidraw package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.15.3
• Patched version(s): 0.15.3

References

• GHSA-v7v8-gjv7-ffmr
• security.snyk.io
• CVE-2023-26140
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Stored Cross-site Scripting (XSS) in excalidraw's web embed component - CVE-2024-32472
• Vega has Cross-site Scripting vulnerability in `lassoAppend` function - CVE-2023-26487
• Layui cross-site scripting (XSS) vulnerability - CVE-2023-50550
• Froala Editor Cross-site Scripting vulnerability - CVE-2023-41592

Tags:

npm

@excalidraw/excalidraw