-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper URL sanitization in link handling. The commit diff shows the original normalizeLink function in Hyperlink.tsx was replaced with a version using @braintree/sanitize-url. The old implementation (visible in removed code from Hyperlink.tsx) only trimmed whitespace and added HTTPS prefixes without proper protocol validation or sanitization, making it vulnerable to XSS via crafted URIs like javascript: payloads. The patch moved normalization to src/data/url.ts using a proper sanitization library, confirming the original function was insufficient.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @excalidraw/excalidraw | npm | < 0.15.3 | 0.15.3 |
Ongoing coverage of React2Shell