p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in @excalidraw/excalidraw

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für @excalidraw/excalidraw: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 3

  1. GHSA-39h7-pwv7-rc3x

    Nicht bewertetKorrektur verfügbar

    Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)

    ### Impact `@excalidraw/[email protected]` depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path. This is patched in `@excalidraw/[email protected]` by updating `@excalidraw/mermaid-to-excalidraw` to `2.2.2`, which uses a patched Mermaid 11 release. Moderate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link). ### Patches

    @excalidraw/excalidrawNode.js
    • Auf 0.18.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2024-32472

    Mittel · CVSS 6.1EPSS 0,56%Korrektur verfügbar

    excalidraw vulnerable to a Stored XSS in excalidraw's web embed component

    excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as iframe's `srcdoc` without properly sanitizing against HTML injection. Second by improperly sanitizing against attribute HTML injection. This in conjunction with allowing `allow-same-origin` sandbox flag (necessary for several embeds) resulted in the XSS. This vulnerability is fixed in 0.17.6 and 0.16.4.

    @excalidraw/excalidraw @excalidraw/excalidrawNode.js
    • Auf 0.16.4 aktualisieren
    • Auf 0.17.6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →