CVE-2026-30587

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...

EUVD-2024-1241

Malicious code in bioql PyPI...

EUVD-2023-2357

Malicious code in bioql PyPI...

@8btc/excalidraw (>=0.18.0-beta.0, <=0.18.0-beta.4), @alkemio/excalidraw (>=0.17.1-alkemio-5, <=0.19.0-alkemio-1) +151 more potentially affected by CVE-2025-54881 via mermaid (>=10.9.0, <=10.9.3)

mermaid NPM version =10.9.0, =0.18.0-beta.0, =0.17.1-alkemio-5, =1.0.0, =0.18.3, =0.18.0-1, =0.0.1-BETA, =1.1.4, =0.0.1, =0.114.3, =0.0.4-2, =0.0.1, =0.5.0-1848650, =0.17.1, =0.17.3 and more Source cves: CVE-2025-54881 Source advisory: OSV:GHSA-7RQQ-PRVP-X9JH...

CVE-2024-32472

excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as...

CVE-2023-26140

Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting XSS via embedded links in whiteboard objects due to improper input sanitization...

@alkemio/excalidraw (>=0.17.0-alkemio-1, <=0.17.6-alkemio-4), @betternotion/excalidraw (>=0.0.1-BETA, <=1.1.1) +140 more potentially affected by unknown CVE via mermaid (>=10.0.0, <=10.9.2)

mermaid NPM version =10.0.0, =0.17.0-alkemio-1, =0.0.1-BETA, =0.17.1, =0.0.19, =3.0.0, =0.0.12, =0.114.3, =0.4.0-1437953, =0.17.1, =18.0.3, =18.0.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-M4GQ-X24J-JPMF...

Cross Site Scripting (XSS)

@excalidraw/excalidraw is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper sanitization against HTML injection in two vectors: rendering untrusted strings as iframe's srcdoc and attribute HTML injection in conjunction with allowing the allow-same-origin sandbox flag...

CVE-2024-32472

excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as...

@flowes/editor-next (>=0.0.24, <=0.0.41), @hyperbook/element-excalidraw (>=0.6.0, <=0.6.1) +1 more potentially affected by CVE-2024-32472 via @excalidraw/excalidraw (0.16.1)

@excalidraw/excalidraw NPM version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on @excalidraw/excalidraw and may be impacted: - @flowes/editor-next =0.0.24, =0.6.0, =0.6.1 - @udecode/plate-excalidraw 31.1.0 Source cves: CVE-2024-32472 Source...

Stored Cross-site Scripting (XSS) in excalidraw's web embed component

Summary A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. Poc Inserting an embed with the below url can be copy/pasted onto canvas to insert as embed will log 42 to the console:...

@haklex/rich-ext-excalidraw (>=0.0.51, <=0.3.4), @haklex/rich-kit-shiro (>=0.0.51, <=0.3.4) +38 more potentially affected by CVE-2024-32472 via @excalidraw/excalidraw (>=0.17.0, <=0.17.3)

@excalidraw/excalidraw NPM version =0.17.0, =0.0.51, =0.0.51, =0.0.51, =0.0.51, =0.0.71, =0.0.71, =0.0.71, =0.0.71, =0.0.71, =0.0.71, =0.0.71, =0.0.71, =0.0.71, =0.0.71, =0.0.71, =0.0.72 and more Source cves: CVE-2024-32472 Source advisory: OSV:GHSA-M64Q-4JQH-F72F...

GHSA-M64Q-4JQH-F72F Stored Cross-site Scripting (XSS) in excalidraw's web embed component

Summary A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. Poc Inserting an embed with the below url can be copy/pasted onto canvas to insert as embed will log 42 to the console:...

CVE-2024-32472 excalidraw vulnerable to a Stored XSS in excalidraw's web embed component

excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as...

CVE-2024-32472 excalidraw vulnerable to a Stored XSS in excalidraw's web embed component

excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as...

CVE-2024-32472

The CVE-2024-32472 entry details a stored XSS in Excalidraw’s web embeddable component. Two vectors exist: (1) untrusted content rendered as an iframe srcdoc without proper HTML sanitization, and (2) improper sanitization against attribute HTML injection, exacerbated by allow-same-origin in the s...

CVE-2024-32472 excalidraw vulnerable to a Stored XSS in excalidraw's web embed component

excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as...

CVE-2024-32472

creationtimestamp| type| source ---|---|--- 2024-04-17 21:15:16+00:00| published-proof-of-concept| https://github.com/excalidraw/excalidraw/security/advisories/GHSA-m64q-4jqh-f72f...

PT-2024-24599 · Unknown · Excalidraw

Name of the Vulnerable Software and Affected Versions: Excalidraw versions 0.16.x through 0.17.5 Excalidraw version 0.16.3 and earlier Description: A stored XSS vulnerability in Excalidraw's web embeddable component allows arbitrary JavaScript to be run in the context of the domain where the edit...

excalidraw 安全漏洞

excalidraw is a software application. Virtual whiteboard sketch hand drawing A security vulnerability exists in excalidraw versions prior to 0.16.0 through 0.17.6, which stems from a stored cross-site scripting XSS vulnerability in the web embeddable component...