Skip to content
OpenAdvisories

Package · npm

@excalidraw/excalidraw

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium —
    GHSA-39h7-pwv7-rc3x

    Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)

    ### Impact `@excalidraw/excalidraw@0.18.0` depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s K…

    @excalidraw/excalidraw @excalidraw/mermaid-to-excalidraw npm
  • Medium 6.1
    CVE-2024-32472

    excalidraw vulnerable to a Stored XSS in excalidraw's web embed component

    excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. …

    excalidraw excalidraw @excalidraw/excalidraw npm
  • Medium 6.1
    CVE-2023-26140

    @excalidraw/excalidraw Cross-site Scripting vulnerability

    Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objects due to improper input sanitization.

    @excalidraw/excalidraw npm