PT-2023-20504 · Raysan5 · Raylib

Eugene Lim · Published 2023-04-14 · Updated 2023-04-21 · CVE-2023-26123

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions raysan5/raylib versions prior to 4.5.0

Description The issue is related to Cross-site Scripting (XSS) where the SetClipboardText API does not properly escape the character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via theemscripten run script` function. This vulnerability is present only when compiling raylib for PLATFORM WEB, and all other Desktop/Mobile/Embedded platforms are not affected.

Recommendations For versions prior to 4.5.0, update to version 4.5.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the SetClipboardText API when compiling for PLATFORM WEB until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-26123

Affected Products

Raylib

References · 7

• 🔥 https://github.com/raysan5/raylib/issues/2954 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-UNMANAGED-RAYSAN5RAYLIB-5421188 · Exploit
• https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d · Patch
• https://osv.dev/vulnerability/CVE-2023-26123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26123 · Security Note
• https://github.com/raysan5/raylib/releases/tag/4.5.0 · Note
• https://t.me/cvenotify/48209 · Telegram Post