6.1 Medium

CVE-2023-26140 Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded…

Description

Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objects due to improper input sanitization.

Affected products and versions

Product	Affected versions	Fixed in
@excalidraw/excalidraw 0.0	0.0.0 → latest	No fix stated

Do you use @excalidraw/excalidraw?

Track this CVE Watch @excalidraw/excalidraw Check my SBOMs

www.cveye.io/en/cve/CVE-2023-26140

Timeline

Published August 16, 2023
Last modified October 2, 2024

References

security.snyk.io security.snyk.io
github.com github.com
github.com github.com

Track this CVE