GitHub Advisoryadvisory · npm

GHSA-v7v8-gjv7-ffmr @excalidraw/excalidraw Cross-site Scripting vulnerability

MEDIUM Published 2023-08-16 Modified 2023-08-16 Official page ↗
Aliases
CVE-2023-26140
Ecosystem
npm
Packages
@excalidraw/excalidraw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-08-16

Affected packages

• npm @excalidraw/excalidraw: < 0.15.3 → fixed in 0.15.3

Description

Impact XSS vulnerability due to improperly sanitizing URLs of links that can be attached on canvas elements. This affects users of the npm package `@excalidraw/excalidraw` provided it was deployed in environments where untrusted user input in drawings that are then shared with third parties is a concern. If you only hosted the editor in trusted environments, or sharing didn't take place, the impact is minimized. Patches Patch is available on version 0.15.3 and up (stable), or latest `@excalidraw/excalidraw@next` (unstable releases). Workarounds No workaround without upgrading unless deployed in environments without untrusted user input. References https://security.snyk.io/vuln/SNYK-JS-EXCALIDRAWEXCALIDRAW-5841658 https://github.com/excalidraw/excalidraw/pull/6728

Related

Alias · CVE (1)

  • CVE-2023-26140 Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References