Stored Cross-site Scripting (XSS) in excalidraw's web embed component

Description

A stored XSS vulnerability in Excalidraw’s web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted.

Recommendation

Update the @excalidraw/excalidraw package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.17.0, < 0.17.6

  >= 0.16.0, < 0.16.4**

• Patched version(s): **0.17.6

  0.16.4**

References

• GHSA-m64q-4jqh-f72f
• CVE-2024-32472
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• VvvebJs Reflected Cross-Site Scripting (XSS) vulnerability - CVE-2024-29271
• Cross-site scripting (XSS) in the clipboard package - CVE-2024-45613
• vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS) - CVE-2024-6783
• Froala WYSIWYG editor allows cross-site scripting (XSS) - CVE-2024-51434

Tags:

npm

@excalidraw/excalidraw