Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-97224: Excalidraw imported files can execute malicious scripts
CVE-2026-97224 · published 25 days ago
Summary
Versions of Excalidraw up to 0.18.1 allow a specially crafted imported file to inject and run code in a user’s browser. An attacker can send such a file remotely, potentially stealing data or taking over a user’s session. Upgrade to the latest Excalidraw release or apply the vendor’s patch and avoid opening files from untrusted sources.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| – | excalidraw | 0.18.0 |
Original advisory text
Excalidraw Imported File restore.ts cross site scripting
A vulnerability was detected in Excalidraw up to 0.18.1. The impacted element is an unknown function of the file packages/excalidraw/data/restore.ts of the component Imported File Handler. Performing a manipulation of the argument customData.generationData.html results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.1
Low
Type
CWE-79Cross-site Scripting (XSS)
CWE-94Code Injection
Timeline
Published24 Sep 2026
Updated19 Oct 2026
First seen24 Sep 2026
Track software like this
Free during beta