CVE-2023-26140: XSS
Impact
XSS vulnerability due to improperly sanitizing URLs of links that can be attached on canvas elements. This affects users of the npm package @excalidraw/excalidraw provided it was deployed in environments where untrusted user input in drawings that are then shared with third parties is a concern. If you only hosted the editor in trusted environments, or sharing didn't take place, the impact is minimized.
Patches
Patch is available on version 0.15.3 and up (stable), or latest @excalidraw/excalidraw@next (unstable releases).
Workarounds
No workaround without upgrading unless deployed in environments without untrusted user input.
References
https://security.snyk.io/vuln/SNYK-JS-EXCALIDRAWEXCALIDRAW-5841658 https://github.com/excalidraw/excalidraw/pull/6728
Other sources
Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objects due to improper input sanitization.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-26140?
CVE-2023-26140 is classified as a Cross-Site Scripting (XSS) vulnerability which can potentially allow attackers to execute harmful scripts in the context of a user's session.
How do I fix CVE-2023-26140?
To fix CVE-2023-26140, update the @excalidraw/excalidraw package to version 0.15.4 or higher, which includes the necessary sanitization improvements.
What causes CVE-2023-26140?
CVE-2023-26140 is caused by improperly sanitizing URLs in links attached to canvas elements, allowing untrusted user input to lead to XSS vulnerabilities.
Who is affected by CVE-2023-26140?
Users of the npm package @excalidraw/excalidraw, particularly those using versions prior to 0.15.4 in environments that accept untrusted input, are affected by CVE-2023-26140.
What should I do if I cannot update due to dependencies for CVE-2023-26140?
If updating is not feasible due to dependency issues, review your code to ensure proper sanitization of URLs before incorporating user input into the canvas.