# CVE-2026-97224: Excalidraw cross-site scripting in imported file handler

Source: https://junglewise.ai/threats/cve-2026-97224-a-vulnerability-was-detected-in-excalidraw-up-to-0-18-1-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-97224 · Severity: medium · CVSS 4.3 · Published 2026-09-24

Excalidraw, a web-based drawing application, contains a cross-site scripting vulnerability in its file import functionality. An attacker can craft a malicious file with manipulated HTML data that, when imported by a user, executes arbitrary JavaScript in the context of the user's browser. This could allow theft of session cookies, stored data, or impersonation of the user within the application.

Technologies: [Excalidraw](https://junglewise.ai/threats/technologies/excalidraw). Vendors: [Excalidraw](https://junglewise.ai/threats/vendors/excalidraw).

## Quick answers

**Is CVE-2026-97224 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97224 being exploited in the wild.

**How severe is CVE-2026-97224?** Medium severity, with a CVSS score of 4.3, published 24 September 2026.

**Which products and versions are affected?** Excalidraw up to 0.18.1.

**Is there a fix for CVE-2026-97224?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-97224 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-97224?** Check whether you run Excalidraw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in packages/excalidraw/data/restore.ts within the imported file handler, where user-supplied customData.generationData.html is not properly sanitized before use. An attacker can remotely trigger the XSS by providing a crafted file that a user imports. The attack requires user interaction (importing a file) and results in JavaScript execution with the victim's privileges.

## Affected products

- Excalidraw Excalidraw up to 0.18.1

## Timeline

- 2026-09-24: disclosed: Public disclosure; vendor did not respond to early notification

## References

- [https://vuldb.com/cve/CVE-2026-97224](https://vuldb.com/cve/CVE-2026-97224)
- [https://vuldb.com/submit/907811](https://vuldb.com/submit/907811)

## Related threats

- [Excalidraw XSS in Mermaid sequence diagram labels via KaTeX](https://junglewise.ai/threats/excalidraw-xss-via-mermaid-sequence-diagram-labels-47685552)
- [Excalidraw stored cross-site scripting in web embed component](https://junglewise.ai/threats/cve-2024-32472-excalidraw-stored-cross-site-scripting-in-web-embed-component)
- [Excalidraw Cross-site Scripting in canvas element links](https://junglewise.ai/threats/cve-2023-26140-excalidraw-cross-site-scripting-in-canvas-element-links)
- [Excalidraw cross-site scripting in embedded links](https://junglewise.ai/threats/excalidraw-cross-site-scripting-in-embedded-links-403a9a98)