CVE-2024-32472 json
excalidraw vulnerable to a Stored XSS in excalidraw's web embed component
published 2024-04-17 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1241 , GHSA-m64q-4jqh-f72f
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as iframe's `srcdoc` without properly sanitizing against HTML injection. Second by improperly sanitizing against attribute HTML injection. This in conjunction with allowing `allow-same-origin` sandbox flag (necessary for several embeds) resulted in the XSS. This vulnerability is fixed in 0.17.6 and 0.16.4.
Patch / fix
- npm @excalidraw/excalidraw 0.16.4, 0.17.6
- excalidraw excalidraw 0.16.4, 0.17.6
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.56% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @excalidraw/excalidraw | >=0.16.0, <0.16.4 >=0.17.0, <0.17.6 |
0.16.4 0.17.6 |
Affected products
- excalidraw excalidraw
Classification
References
-
github.com
/excalidraw/excalidraw/commit/6be752e1b6d776ccfbd3bb9eea17463cb264121d
web
-
github.com
/excalidraw/excalidraw/commit/988f81911ca58e3ca2583e0dd44a954dd00e09d0
web
-
github.com
/excalidraw/excalidraw/security/advisories/GHSA-m64q-4jqh-f72f
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-32472
advisory
-
github.com
/excalidraw/excalidraw
package
Sources
- CVE List CVE-2024-32472
- GitHub Advisory GHSA-m64q-4jqh-f72f
- NVD CVE-2024-32472
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.