Description
A stored XSS vulnerability in Excalidraw’s web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted.
Recommendation
Update the @excalidraw/excalidraw package to the latest compatible version. Followings are version details:
Affected version(s): **>= 0.17.0, < 0.17.6 >= 0.16.0, < 0.16.4** Patched version(s): **0.17.6 0.16.4**
References
Could your website be exposed too?
SmartScanner can check your website for Stored Cross-site Scripting (XSS) in excalidraw's web embed component and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - CVE-2024-29881
- Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting - CVE-2024-9148
- Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section - CVE-2024-47819
- Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes - CVE-2024-6485
You might also like:
See something that needs correcting? Let us knowUpdated April 18, 2024