Description

Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objects due to improper input sanitization.

Remediation

References

https://github.com/excalidraw/excalidraw/commit/b33fa6d6f64d27adc3a47b25c0aa55711740d0af

https://security.snyk.io/vuln/SNYK-JS-EXCALIDRAWEXCALIDRAW-5841658

https://github.com/excalidraw/excalidraw/pull/6728

Related Vulnerabilities

CVE-2023-27848 Vulnerability in npm package broccoli-compass

CVE-2022-41940 Vulnerability in maven package org.webjars.bower:engine.io

CVE-2021-23631 Vulnerability in npm package convert-svg-core

CVE-2010-4172 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

CVE-2022-35954 Vulnerability in npm package @actions/core

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Patch Third Party Advisory Issue Tracking