CVE-2024-32472

excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as iframe's `srcdoc` without properly sanitizing against HTML injection. Second by improperly sanitizing against attribute HTML injection. This in conjunction with allowing `allow-same-origin` sandbox flag (necessary for several embeds) resulted in the XSS. This vulnerability is fixed in 0.17.6 and 0.16.4.

• CWE-79
• CWE-80

• https://github.com/excalidraw/excalidraw/commit/6be752e1b6d776ccfbd3bb9eea17463cb264121d
• https://github.com/excalidraw/excalidraw/commit/988f81911ca58e3ca2583e0dd44a954dd00e09d0
• https://github.com/excalidraw/excalidraw/security/advisories/GHSA-m64q-4jqh-f72f
• https://github.com/excalidraw/excalidraw/commit/6be752e1b6d776ccfbd3bb9eea17463cb264121d
• https://github.com/excalidraw/excalidraw/commit/988f81911ca58e3ca2583e0dd44a954dd00e09d0
• https://github.com/excalidraw/excalidraw/security/advisories/GHSA-m64q-4jqh-f72f

Published

Apr 17, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32466Tolgee is an open-source localization platform. For the `/v2…4.3
• CVE-2024-32467MeterSphere is an open source continuous testing platform. P…6.5
• CVE-2024-32468Deno is a runtime for JavaScript and TypeScript written in r…5.4
• CVE-2024-32469Decidim is a participatory democracy framework. The paginati…7.1
• CVE-2024-3247In Xpdf 4.05 (and earlier), a PDF object loop in an object s…5.5
• CVE-2024-32470Tolgee is an open-source localization platform. When API key…6.5
• CVE-2024-32473Moby is an open source container framework that is a key com…6.5
• CVE-2024-32474Sentry is an error tracking and performance monitoring platf…6.5
• CVE-2024-32475Envoy is a cloud-native, open source edge and service proxy.…7.5
• CVE-2024-32476Argo CD is a declarative, GitOps continuous delivery tool fo…6.5
• CVE-2024-32477Deno is a JavaScript, TypeScript, and WebAssembly runtime wi…7.4
• CVE-2024-32478Git Credential Manager (GCM) is a secure Git credential help…6.9