Stored XSS in Excalidraw via unsanitized customData.generationData.html allows sandboxed script execution (CVE-2026-97224)
A stored cross-site scripting vulnerability (CVE-2026-97224) exists in Excalidraw, an open-source diagramming tool, due to improper handling of the customData.generationData.html field in .excalidraw files. When a specially crafted .excalidraw file is loaded, attacker-controlled HTML and JavaScript in this field is embedded directly into an iframe's srcdoc attribute without sanitization, enabling script execution within a sandboxed iframe. The iframe sandbox restricts same-origin access but allows scripting, form submissions, pop-ups, and downloads, enabling phishing and social-engineering attacks leveraging the trusted Excalidraw interface. The vulnerability arises from forward compatibility code that preserves unknown element fields without validation, conflating state checks with trust, and treats imported generationData as trusted. A minimal fix involves dropping imported generationData from iframe and embeddable elements during scene restoration to block this attack vector. No official patch was available at the time of disclosure, exposing users to risk especially in collaborative environments where malicious elements may synchronize to other users. This case exemplifies the trade-offs between forward compatibility and security in file format parsing and the importance of provenance validation separate from state validation.
Entenda a falha
A vulnerabilidade
CVE-2026-97224 is a stored XSS in Excalidraw, the open-source diagramming tool. A crafted .excalidraw file can carry HTML and JavaScript in customData.generationData.html, which is placed in an iframe srcdoc without sanitization. The victim only has to open the file (or receive the element in a collaborative session). Script runs in a sandboxed iframe without allow-same-origin, so cookies and the parent DOM are not reachable, but scripts, forms, pop-ups and downloads are allowed, enabling phishing inside the trusted interface. The articles name no affected or fixed versions, and no official patch existed at disclosure.
Como funciona
When a user opens a file or drags it onto the canvas, each JSON element goes through restoreElements, restoreElement and restoreElementWithProperties. The customData field is copied as is. Later, renderEmbeddables in App.tsx handles iframe elements: it reads el.customData.generationData, falling back to an in-memory map of live AI generations. If the object's status is "done", it returns the html string as the iframe's srcdoc. The browser then renders that string as a full HTML document with scripts allowed.
Por que é vulnerável
Forward-compatibility code spreads the original element properties to avoid losing unknown fields, and customData is accepted without type checks, structure validation or key allowlist. The file data and the trusted in-memory generation data merge through the ?? operator, so origin is lost. The status === "done" check is a state guard, not a trust guard, and the attacker controls it. The done branch returns html verbatim, while other branches use fixed templates. The proposed minimal fix is to drop imported generationData from iframe and embeddable elements during scene restoration.
Onde está
packages/excalidraw/data/restore.ts (restoreElementWithProperties, lines 515–518) and packages/excalidraw/components/App.tsx (renderEmbeddables, lines 1842–1860, and the iframe sandbox at lines 2047–2069).
Como foi descoberta
The Yokai research team (Hakai Security) found the flaw while analyzing Excalidraw's element import and restoration process, and documented it with a minimal reproducible example in a write-up published on 2026-11-14. The articles do not say whether the maintainers were notified beforehand; they state no official patch was available at disclosure.
PoC pública
The Yokai write-up includes a minimal reproducible example: a hand-crafted .excalidraw file with an iframe element whose generationData carries a short script that only logs a message to the browser console. It shows script execution inside the sandboxed iframe, a verification-level demonstration. Since the technique is public and no patch exists, exposure is real, especially for files received from untrusted sources and collaborative sessions.
Publicada em: yokai.hakaisecurity.io/en-the-drawing-that-steals-passwords-stored-xss-in-excalidraw-via-customdata-cve-2026-97224/ ↗
Explicação gerada por IA a partir da matéria e dos artigos, em 14/11/2026 13:16.
Linha do tempo
-
Stored XSS in Excalidraw via unsanitized customData.generationData.html allows sandboxed script execution (CVE-2026-97224)
ler a análise desta fonte ocultar
A stored cross-site scripting vulnerability (CVE-2026-97224) exists in Excalidraw, an open-source diagramming tool, due to improper handling of the customData.generationData.html field in .excalidraw files. When a specially crafted .excalidraw file is loaded, attacker-controlled HTML and JavaScript in this field is embedded directly into an iframe's srcdoc attribute without sanitization, enabling script execution within a sandboxed iframe. The iframe sandbox restricts same-origin access but allows scripting, form submissions, pop-ups, and downloads, enabling phishing and social-engineering attacks leveraging the trusted Excalidraw interface. The vulnerability arises from forward compatibility code that preserves unknown element fields without validation, conflating state checks with trust, and treats imported generationData as trusted. A minimal fix involves dropping imported generationData from iframe and embeddable elements during scene restoration to block this attack vector. No official patch was available at the time of disclosure, exposing users to risk especially in collaborative environments where malicious elements may synchronize to other users. This case exemplifies the trade-offs between forward compatibility and security in file format parsing and the importance of provenance validation separate from state validation.