# CVE-2024-32472: Excalidraw stored cross-site scripting in web embed component

Source: https://junglewise.ai/threats/cve-2024-32472-excalidraw-stored-cross-site-scripting-in-web-embed-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-04-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-32472 · Severity: low · CVSS 3.1 · Published 2024-04-17

Excalidraw is a popular open-source whiteboarding and diagramming tool used for creating collaborative drawings. A stored cross-site scripting (XSS) vulnerability in its web embed component allows attackers to inject malicious JavaScript code that executes in the context of the hosting domain, potentially compromising user sessions and enabling data theft or defacement of drawings.

Technologies: [Excalidraw](https://junglewise.ai/threats/technologies/excalidraw). Vendors: [Excalidraw](https://junglewise.ai/threats/vendors/excalidraw).

## Quick answers

**Is CVE-2024-32472 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-32472 being exploited in the wild.

**How severe is CVE-2024-32472?** Low severity, with a CVSS score of 3.1, published 17 April 2024.

**Which products and versions are affected?** Excalidraw 0.16.0 to 0.17.5 (patched in 0.16.4 and 0.17.6).

**Is there a fix for CVE-2024-32472?** A patch was published on 2024-04-17: Fixed in versions 0.16.4 and 0.17.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-32472 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-32472?** Check whether you run Excalidraw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from improper sanitization in Excalidraw's web embed component when handling iframe srcdoc attributes and HTML attributes. An attacker can craft a malicious embed URL containing script tags that bypass sanitization filters, allowing arbitrary JavaScript execution in the same origin. The root cause involved rendering untrusted strings directly as iframe srcdoc content and inadequate attribute-level HTML injection prevention. The attack requires user interaction (inserting an embed into a canvas) but no authentication. Patches were released in versions 0.16.4 and 0.17.6, fixing sanitization logic and restricting the allow-same-origin sandbox flag to only cases that require it.

## Affected products

- Excalidraw excalidraw 0.16.0 to 0.17.5 (patched in 0.16.4 and 0.17.6)

## Identifiers

- CVE-2024-32472
- GHSA-m64q-4jqh-f72f

## Timeline

- 2024-04-17: disclosed: Vulnerability published as GHSA-m64q-4jqh-f72f and CVE-2024-32472
- 2024-04-17: patched: Fixed in versions 0.16.4 and 0.17.6

## References

- [https://github.com/excalidraw/excalidraw/security/advisories/GHSA-m64q-4jqh-f72f](https://github.com/excalidraw/excalidraw/security/advisories/GHSA-m64q-4jqh-f72f)

## Related threats

- [Excalidraw cross-site scripting in imported file handler](https://junglewise.ai/threats/cve-2026-97224-a-vulnerability-was-detected-in-excalidraw-up-to-0-18-1-the)
- [Excalidraw XSS in Mermaid sequence diagram labels via KaTeX](https://junglewise.ai/threats/excalidraw-xss-via-mermaid-sequence-diagram-labels-47685552)
- [Excalidraw Cross-site Scripting in canvas element links](https://junglewise.ai/threats/cve-2023-26140-excalidraw-cross-site-scripting-in-canvas-element-links)
- [Excalidraw cross-site scripting in embedded links](https://junglewise.ai/threats/excalidraw-cross-site-scripting-in-embedded-links-403a9a98)