@hyperbook/web-component-excalidraw (>=0.3.2, <=0.3.3), @hyperbook/web-component-learningmap (0.1.0) +24 more potentially affected by unknown CVE via @excalidraw/excalidraw (0.18.0-4872083)

@excalidraw/excalidraw NPM version 0.18.0-4872083 is affected by a known vulnerability. The following packages have a transitive dependency on @excalidraw/excalidraw and may be impacted: - @hyperbook/web-component-excalidraw =0.3.2, =52.0.11, =6.0.4, =0.1.0, =1.0.5, =50.3.0, =0.132.0-next.1,...

@flowes/editor-next (>=0.0.24, <=0.0.41), @hyperbook/element-excalidraw (>=0.6.0, <=0.6.1) +1 more potentially affected by CVE-2024-32472 via @excalidraw/excalidraw (0.16.1)

@excalidraw/excalidraw NPM version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on @excalidraw/excalidraw and may be impacted: - @flowes/editor-next =0.0.24, =0.6.0, =0.6.1 - @udecode/plate-excalidraw 31.1.0 Source cves: CVE-2024-32472 Source...

Cross site scripting

Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting XSS via embedded links in whiteboard objects due to improper input sanitization...

CVE-2023-26140

CVE-2023-26140 : The npm package @excalidraw/excalidraw (version 0.0.0) is vulnerable to Cross-site Scripting (XSS) due to improper input sanitization of linked URLs in whiteboard objects. Root cause: insufficient sanitization on URLs attached to canvas elements. Impact: XSS with potential user i...

@blocklet/discuss-kit (>=1.0.8, <=2.0.172), @blocklet/discuss-kit-post (>=1.6.254, <=2.0.172) +62 more potentially affected by CVE-2023-26140 via @excalidraw/excalidraw (>=0.4.3, <=0.15.3)

@excalidraw/excalidraw NPM version =0.4.3, =1.0.8, =1.6.254, =1.0.8, =0.0.2, =0.0.6, =1.0.0, =0.0.1, =0.0.1, =0.0.2, =30.1.2, =0.0.0, =0.0.5, =0.0.32 and more Source cves: CVE-2023-26140 Source advisory: SNYK:JS-EXCALIDRAWEXCALIDRAW-5841658...