Stored Cross-site Scripting (XSS) in excalidraw's web embed component

Description

A stored XSS vulnerability in Excalidraw’s web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted.

Recommendation

Update the @excalidraw/excalidraw package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.17.0, < 0.17.6

  >= 0.16.0, < 0.16.4**

• Patched version(s): **0.17.6

  0.16.4**

References

• GHSA-m64q-4jqh-f72f
• CVE-2024-32472
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - CVE-2024-29881
• Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting - CVE-2024-9148
• Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section - CVE-2024-47819
• Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes - CVE-2024-6485

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

Tags:

npm

@excalidraw/excalidraw