Executive brief
Canva Desktop, a widely-used online design platform with over 220 million monthly active users, contained a flaw in how it processed deeplinks that could allow an attacker to trick the application into loading malicious content. An attacker could craft a specially-formatted link that, when opened by a user, would cause Canva to load arbitrary web content under the user's session, potentially leading to unauthorized actions or data exposure.
Technical details
The vulnerability exists in the deeplink handler of Canva Desktop prior to v1.125.0, which performed double decoding of URL parameters. This double-decoding flaw allows an attacker to bypass intended URL validation/filtering by encoding payloads in a way that survives the initial decode step and resolves to malicious URLs on the second decode. The attack is delivered via a crafted deeplink (URL scheme) that the user must open, making user interaction a prerequisite. An attacker can cause the application to load arbitrary same-origin content under the victim's authenticated session, potentially enabling session hijacking, account manipulation, or unauthorized data access. The issue was resolved in version 1.125.0.
Affected products
- Canva Desktop before 1.125.0
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Fix available in version 1.125.0