Stored Cross-site Scripting (XSS) in excalidraw's web embed component

Description

A stored XSS vulnerability in Excalidraw’s web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted.

Recommendation

Update the @excalidraw/excalidraw package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.17.0, < 0.17.6

  >= 0.16.0, < 0.16.4**

• Patched version(s): **0.17.6

  0.16.4**

References

• GHSA-m64q-4jqh-f72f
• CVE-2024-32472
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• CodeceptJS's incomprehensive sanitation can lead to Command Injection - CVE-2025-57285
• Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) 2 - CVE-2025-4643
• The AuthKit React Router Library rendered sensitive auth data in HTML - CVE-2025-55008
• Vite allows server.fs.deny to be bypassed with .svg or relative paths - CVE-2025-31486

Tags:

npm

@excalidraw/excalidraw