Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Low severity, with a CVSS score of 3.1, published 16 August 2023.
- Which products and versions are affected?
- Excalidraw 0.0.0 to 0.15.2; @excalidraw/excalidraw (npm) SEMVER:introduced=0,fixed=0.15.3.
- Is there a fix for This vulnerability?
- Yes. @excalidraw/excalidraw (npm): upgrade to 0.15.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether you run Excalidraw or @excalidraw/excalidraw (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @excalidraw/excalidraw (npm): upgrade to 0.15.3 or later
npm install @excalidraw/excalidraw@0.15.3
Technical details
The vulnerability is a CWE-79 cross-site scripting (XSS) flaw in @excalidraw/excalidraw where embedded links in whiteboard objects were not properly sanitized. The root cause was insufficient input validation in the link normalization logic. An attacker can craft a whiteboard containing a malicious link that, when opened by a user, executes arbitrary JavaScript in the context of the web application. The attack requires user interaction (clicking the link) and is network-reachable. The fix was implemented in version 0.15.3 via stronger enforcement of the normalizeLink function.
Affected products
- Excalidraw excalidraw 0.0.0 to 0.15.2
Timeline
- 2023-08-16: disclosed
- 2023-06-29: patched: Fix merged in PR #6728
- 2023-08-16: other: Advisory withdrawn as duplicate of GHSA-v7v8-gjv7-ffmr