@flowes/editor-next (>=0.0.24, <=0.0.41), @hyperbook/element-excalidraw (>=0.6.0, <=0.6.1) +1 more potentially affected by CVE-2024-32472 via @excalidraw/excalidraw (0.16.1)

@excalidraw/excalidraw NPM version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on @excalidraw/excalidraw and may be impacted: - @flowes/editor-next =0.0.24, =0.6.0, =0.6.1 - @udecode/plate-excalidraw 31.1.0 Source cves: CVE-2024-32472 Source...

Cross site scripting

Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting XSS via embedded links in whiteboard objects due to improper input sanitization...

CVE-2023-26140

Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting XSS via embedded links in whiteboard objects due to improper input sanitization...

CVE-2023-26140

CVE-2023-26140 : The npm package @excalidraw/excalidraw (version 0.0.0) is vulnerable to Cross-site Scripting (XSS) due to improper input sanitization of linked URLs in whiteboard objects. Root cause: insufficient sanitization on URLs attached to canvas elements. Impact: XSS with potential user i...

CVE-2023-26140: Improper Neutralization of Input During Web Page Generation

Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting XSS via embedded links in whiteboard objects due to improper input sanitization...

@blocklet/discuss-kit (>=1.0.8, <=2.0.172), @blocklet/discuss-kit-post (>=1.6.254, <=2.0.172) +62 more potentially affected by CVE-2023-26140 via @excalidraw/excalidraw (>=0.4.3, <=0.15.3)

@excalidraw/excalidraw NPM version =0.4.3, =1.0.8, =1.6.254, =1.0.8, =0.0.2, =0.0.6, =1.0.0, =0.0.1, =0.0.1, =0.0.2, =30.1.2, =0.0.0, =0.0.5, =0.0.32 and more Source cves: CVE-2023-26140 Source advisory: SNYK:JS-EXCALIDRAWEXCALIDRAW-5841658...