PT-2023-8844 · Npm · @Excalidraw/Excalidraw
Eugene Lim
·
Publicado
2023-08-15
·
Atualizado
2024-03-30
·
CVE-2023-26140
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
@excalidraw/excalidraw versions 0.0.0 through 0.15.2
Description
The issue is related to Cross-site Scripting (XSS) via embedded links in whiteboard objects due to improper input sanitization. This allows a remote attacker to conduct an XSS attack using a specially crafted link. The vulnerability affects users of the npm package @excalidraw/excalidraw, particularly in environments where untrusted user input in drawings is shared with third parties.
Recommendations
For versions prior to 0.15.3, update to version 0.15.3 or later to resolve the issue.
For users who cannot update immediately, consider deploying the package in environments without untrusted user input to minimize the impact.
As a temporary workaround, consider restricting the sharing of drawings that contain untrusted user input until a patch is applied.
Correção
Special Elements Injection
Improper Neutralization
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
@Excalidraw/Excalidraw