{"action":"Upgrade @excalidraw/excalidraw to 0.16.4 or later.","affected":[{"fixed":"0.16.4","introduced":"0.16.0"},{"fixed":"0.17.6","introduced":"0.17.0"}],"component":"@excalidraw/excalidraw","cve_ids":["CVE-2024-32472"],"ecosystem":"npm","epss":0.00561,"exploited":false,"fixed_versions":["0.16.4","0.17.6"],"ghsa_id":"GHSA-m64q-4jqh-f72f","id":"tcs_01M5KFZRQM2V0KRK7KTA3WQ9F7","modified_at":"2026-09-10T03:50:12.897880448Z","published_at":"2024-04-17T21:32:57Z","references":["https://osv.dev/vulnerability/GHSA-m64q-4jqh-f72f","https://github.com/excalidraw/excalidraw/security/advisories/GHSA-m64q-4jqh-f72f","https://nvd.nist.gov/vuln/detail/CVE-2024-32472","https://github.com/excalidraw/excalidraw/commit/6be752e1b6d776ccfbd3bb9eea17463cb264121d","https://github.com/excalidraw/excalidraw/commit/988f81911ca58e3ca2583e0dd44a954dd00e09d0","https://github.com/excalidraw/excalidraw"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-m64q-4jqh-f72f","url":"https://osv.dev/vulnerability/GHSA-m64q-4jqh-f72f"}],"summary":"Stored Cross-site Scripting (XSS) in excalidraw's web embed component"}