CVE-2023-26123

Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does not properly escape the ' character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via emscripten_run_script function. **Note:** This vulnerability is present only when compiling raylib for PLATFORM_WEB. All the other Desktop/Mobile/Embedded platforms are not affected.

• CWE-79
• CWE-79
• CWE-79

• https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959dPatch
• https://github.com/raysan5/raylib/issues/2954Exploit, Issue Tracking, Third Party Advisory
• https://github.com/raysan5/raylib/releases/tag/4.5.0Release Notes
• https://security.snyk.io/vuln/SNYK-UNMANAGED-RAYSAN5RAYLIB-5421188Exploit, Patch, Third Party Advisory
• https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959dPatch
• https://github.com/raysan5/raylib/issues/2954Exploit, Issue Tracking, Third Party Advisory
• https://github.com/raysan5/raylib/releases/tag/4.5.0Release Notes
• https://security.snyk.io/vuln/SNYK-UNMANAGED-RAYSAN5RAYLIB-5421188Exploit, Patch, Third Party Advisory

Published

Apr 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26118Versions of the package angular from 1.4.9 are vulnerable to…5.3
• CVE-2023-26119Versions of the package net.sourceforge.htmlunit:htmlunit fr…9.8
• CVE-2023-2612Jean-Baptiste Cayrou discovered that the shiftfs file system…4.7
• CVE-2023-26120This affects all versions of the package com.xuxueli:xxl-job…6.1
• CVE-2023-26121All versions of the package safe-eval are vulnerable to Prot…10
• CVE-2023-26122All versions of the package safe-eval are vulnerable to Sand…10
• CVE-2023-26125Versions of the package github.com/gin-gonic/gin before 1.9.…7.3
• CVE-2023-26126All versions of the package m.static are vulnerable to Direc…5.3
• CVE-2023-26127All versions of the package n158 are vulnerable to Command I…7.8
• CVE-2023-26128All versions of the package keep-module-latest are vulnerabl…7.8
• CVE-2023-26129All versions of the package bwm-ng are vulnerable to Command…7.8
• CVE-2023-26130Versions of the package yhirose/cpp-httplib before 0.12.4 ar…8.8