Is CVE-2026-97224 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97224 being exploited in the wild.

How severe is CVE-2026-97224?

Medium severity, with a CVSS score of 4.3, published 24 September 2026.

Is there a fix for CVE-2026-97224?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-97224 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-97224?

Check whether you run Excalidraw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97224: Excalidraw cross-site scripting in imported file handler

CVE-2026-97224 · Severity: medium · CVSS 4.3 · Published 2026-09-24

Excalidraw, a web-based drawing application, contains a cross-site scripting vulnerability in its file import functionality. An attacker can craft a malicious file with manipulated HTML data that, when imported by a user, executes arbitrary JavaScript in the context of the user's browser. This could allow theft of session cookies, stored data, or impersonation of the user within the application.

Technologies: Excalidraw. Vendors: Excalidraw.

Quick answers

Is CVE-2026-97224 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97224 being exploited in the wild.
How severe is CVE-2026-97224?: Medium severity, with a CVSS score of 4.3, published 24 September 2026.
Which products and versions are affected?: Excalidraw up to 0.18.1.
Is there a fix for CVE-2026-97224?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-97224 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-97224?: Check whether you run Excalidraw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in packages/excalidraw/data/restore.ts within the imported file handler, where user-supplied customData.generationData.html is not properly sanitized before use. An attacker can remotely trigger the XSS by providing a crafted file that a user imports. The attack requires user interaction (importing a file) and results in JavaScript execution with the victim's privileges.

Affected products

Excalidraw Excalidraw up to 0.18.1

Timeline

2026-09-24: disclosed: Public disclosure; vendor did not respond to early notification

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.