Stored Cross-site Scripting (XSS) in excalidraw's web embed component

Description

A stored XSS vulnerability in Excalidraw’s web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted.

Recommendation

Update the @excalidraw/excalidraw package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.17.0, < 0.17.6

  >= 0.16.0, < 0.16.4**

• Patched version(s): **0.17.6

  0.16.4**

References

• GHSA-m64q-4jqh-f72f
• CVE-2024-32472
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Strapi Password Hashing is Missing Maximum Password Length Validation - CVE-2025-25298
• DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware - CVE-2025-59037
• Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) 2 - CVE-2025-4643
• The AuthKit React Router Library rendered sensitive auth data in HTML - CVE-2025-55008

Tags:

npm

@excalidraw/excalidraw