{"id":927956,"name":"@excalidraw/excalidraw","ecosystem":"npm","description":"Excalidraw as a React component","homepage":"https://github.com/excalidraw/excalidraw/tree/master/packages/excalidraw","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/excalidraw/excalidraw","keywords_array":["excalidraw","excalidraw-embed","react","npm","npm excalidraw"],"namespace":"excalidraw","versions_count":483,"first_release_published_at":"2020-12-06T12:15:15.608Z","latest_release_published_at":"2026-04-20T20:24:36.743Z","latest_release_number":"0.18.1","latest_published_release_number":"0.18.1","last_synced_at":"2026-10-24T08:17:42.148Z","created_at":"2022-04-07T17:07:00.024Z","updated_at":"2026-10-24T15:17:52.319Z","registry_url":"https://www.npmjs.com/package/@excalidraw/excalidraw","install_command":"npm install @excalidraw/excalidraw","documentation_url":null,"metadata":{"funding":null,"dist-tags":{"patch-v-0.10":"0.10.1","patch":"0.17.1","patch-0.16":"0.16.4","rc":"0.18.0-rc.7","preview":"0.18.0-a9e2d2348-preview-2","test":"0.5.0-a78d45417","latest":"0.18.1","next":"0.18.0-17d8904"},"contentPolicy":null},"repo_metadata":{"id":37010426,"uuid":"231283452","full_name":"excalidraw/excalidraw","owner":"excalidraw","description":"Virtual whiteboard for sketching hand-drawn like diagrams","archived":false,"fork":false,"pushed_at":"2026-10-20T17:29:20.000Z","size":107454,"stargazers_count":134269,"open_issues_count":3361,"forks_count":15765,"subscribers_count":516,"default_branch":"master","last_synced_at":"2026-10-20T17:56:10.267Z","etag":null,"topics":["canvas","collaboration","diagrams","drawing","hacktoberfest","productivity","whiteboard"],"latest_commit_sha":null,"homepage":"https://excalidraw.com","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/excalidraw.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"open_collective":"excalidraw"}},"created_at":"2020-01-02T01:04:43.000Z","updated_at":"2026-10-20T17:15:18.000Z","dependencies_parsed_at":"2023-12-18T20:04:02.550Z","dependency_job_id":"3bc037cd-7993-4e75-a220-d0a15e310dfd","html_url":"https://github.com/excalidraw/excalidraw","commit_stats":{"total_commits":3547,"total_committers":322,"mean_commits":11.01552795031056,"dds":0.8297152523259093,"last_synced_commit":"96ed8a433167f23a5ab54a9d4cca45441c8fd911"},"previous_names":[],"tags_count":19,"template":false,"template_full_name":null,"purl":"pkg:github/excalidraw/excalidraw","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/excalidraw","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/sbom","scorecard":{"id":387651,"data":{"date":"2025-08-11","repo":{"name":"github.com/excalidraw/excalidraw","commit":"dda3affcb081c40e2333cc2019dddadd3a37609f"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.9,"checks":[{"name":"Code-Review","score":9,"reason":"Found 27/30 approved changesets -- score normalized to 9","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'contents' permission set to 'read': .github/workflows/test-coverage-pr.yml:9","Warn: no topLevel permission defined: .github/workflows/autorelease-excalidraw.yml:1","Warn: no topLevel permission defined: .github/workflows/build-docker.yml:1","Warn: no topLevel permission defined: .github/workflows/cancel.yml:1","Warn: no topLevel permission defined: .github/workflows/lint.yml:1","Warn: no topLevel permission defined: .github/workflows/locales-coverage.yml:1","Warn: no topLevel permission defined: .github/workflows/publish-docker.yml:1","Warn: no topLevel permission defined: .github/workflows/semantic-pr-title.yml:1","Warn: no topLevel permission defined: .github/workflows/sentry-production.yml:1","Warn: no topLevel permission defined: .github/workflows/size-limit.yml:1","Warn: no topLevel permission defined: .github/workflows/test-coverage-pr.yml:1","Warn: no topLevel permission defined: .github/workflows/test.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Binary-Artifacts","score":8,"reason":"binaries present in source code","details":["Warn: binary detected: scripts/wasm/hb-subset.wasm:1","Warn: binary detected: scripts/wasm/woff2.wasm:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v0.18.0 not signed: https://api.github.com/repos/excalidraw/excalidraw/releases/205003845","Warn: release artifact v0.17.3 not signed: https://api.github.com/repos/excalidraw/excalidraw/releases/140939679","Warn: release artifact v0.17.0 not signed: https://api.github.com/repos/excalidraw/excalidraw/releases/129357504","Warn: release artifact v0.16.1 not signed: https://api.github.com/repos/excalidraw/excalidraw/releases/121972948","Warn: release artifact v0.16.0 not signed: https://api.github.com/repos/excalidraw/excalidraw/releases/121713259","Warn: release artifact v0.18.0 does not have provenance: https://api.github.com/repos/excalidraw/excalidraw/releases/205003845","Warn: release artifact v0.17.3 does not have provenance: https://api.github.com/repos/excalidraw/excalidraw/releases/140939679","Warn: release artifact v0.17.0 does not have provenance: https://api.github.com/repos/excalidraw/excalidraw/releases/129357504","Warn: release artifact v0.16.1 does not have provenance: https://api.github.com/repos/excalidraw/excalidraw/releases/121972948","Warn: release artifact v0.16.0 does not have provenance: https://api.github.com/repos/excalidraw/excalidraw/releases/121713259"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/publish-docker.yml:9"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/autorelease-excalidraw.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/autorelease-excalidraw.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/autorelease-excalidraw.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/autorelease-excalidraw.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-docker.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/build-docker.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cancel.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/cancel.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/lint.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/lint.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/locales-coverage.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/locales-coverage.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/locales-coverage.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/locales-coverage.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/locales-coverage.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/locales-coverage.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docker.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/publish-docker.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-docker.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/publish-docker.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-docker.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/publish-docker.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-docker.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/publish-docker.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-docker.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/publish-docker.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/semantic-pr-title.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/semantic-pr-title.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sentry-production.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/sentry-production.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sentry-production.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/sentry-production.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/size-limit.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/size-limit.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/size-limit.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/size-limit.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/size-limit.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/size-limit.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-coverage-pr.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/test-coverage-pr.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-coverage-pr.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/test-coverage-pr.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-coverage-pr.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/test-coverage-pr.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/excalidraw/excalidraw/test.yml/master?enable=pin","Warn: containerImage not pinned by hash: .codesandbox/Dockerfile:1: pin your Docker image by updating node:18-bullseye to node:18-bullseye@sha256:0d9e9a8dcd5a83ea737ed92227a6591a31ad70c8bb722b0c51aff7ae23a88b6a","Warn: containerImage not pinned by hash: Dockerfile:1","Warn: containerImage not pinned by hash: Dockerfile:16: pin your Docker image by updating nginx:1.27-alpine to nginx:1.27-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10","Warn: containerImage not pinned by hash: examples/with-script-in-browser/.codesandbox/Dockerfile:1: pin your Docker image by updating node:18-bullseye to node:18-bullseye@sha256:0d9e9a8dcd5a83ea737ed92227a6591a31ad70c8bb722b0c51aff7ae23a88b6a","Warn: downloadThenRun not pinned by hash: .github/workflows/sentry-production.yml:25","Info:   0 out of  16 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   9 third-party GitHubAction dependencies pinned","Info:   0 out of   4 containerImage dependencies pinned","Info:   0 out of   1 downloadThenRun dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":7,"reason":"SAST tool is not run on all commits -- score normalized to 7","details":["Warn: 23 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":0,"reason":"61 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8","Warn: Project is vulnerable to: GHSA-wf5p-g6vw-rhxx","Warn: Project is vulnerable to: GHSA-jr5f-v2jv-69x6","Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7","Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw","Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg","Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x","Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275","Warn: Project is vulnerable to: GHSA-jrvm-mcxc-mf6m","Warn: Project is vulnerable to: GHSA-vhxf-7vqr-mrjg","Warn: Project is vulnerable to: GHSA-mf6x-hrgr-658f","Warn: Project is vulnerable to: GHSA-xrh7-m5pp-39r6","Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc","Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx","Warn: Project is vulnerable to: GHSA-jchw-25xp-jwwc","Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp","Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97","Warn: Project is vulnerable to: GHSA-c7qv-q95q-8v27","Warn: Project is vulnerable to: GHSA-4www-5p9h-95mh","Warn: Project is vulnerable to: GHSA-9gqv-wp59-fq42","Warn: Project is vulnerable to: GHSA-3rfm-jhwj-7488","Warn: Project is vulnerable to: GHSA-hhq3-ff78-jv3g","Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3","Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55","Warn: Project is vulnerable to: GHSA-76c9-3jph-rj3q","Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j","Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w","Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j","Warn: Project is vulnerable to: GHSA-x7hr-w5r2-h6wg","Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw","Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg","Warn: Project is vulnerable to: GHSA-76p7-773f-r4q5","Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p","Warn: Project is vulnerable to: GHSA-w5p7-h5w8-2hfq","Warn: Project is vulnerable to: GHSA-4vvj-4cpr-p986","Warn: Project is vulnerable to: GHSA-wr3j-pwj9-hqq6","Warn: Project is vulnerable to: GHSA-4v9v-hfq4-rm2v","Warn: Project is vulnerable to: GHSA-9jgg-88mc-972h","Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q","Warn: Project is vulnerable to: GHSA-m64q-4jqh-f72f","Warn: Project is vulnerable to: GHSA-fr5h-rqp8-mj6g","Warn: Project is vulnerable to: GHSA-g77x-44xx-532m","Warn: Project is vulnerable to: GHSA-gp8f-8m3g-qvj9","Warn: Project is vulnerable to: GHSA-7gfc-8cq8-jh5f","Warn: Project is vulnerable to: GHSA-7m27-7ghc-44w9","Warn: Project is vulnerable to: GHSA-qpjv-v59x-3qc4","Warn: Project is vulnerable to: GHSA-f82v-jwr5-mffw","Warn: Project is vulnerable to: GHSA-3h52-269p-cp9r","Warn: Project is vulnerable to: GHSA-67mh-4wv8-2f99","Warn: Project is vulnerable to: GHSA-fjxv-7rqg-78g4","Warn: Project is vulnerable to: GHSA-pq67-2wwv-3xjx","Warn: Project is vulnerable to: GHSA-8cj5-5rvv-wf4v","Warn: Project is vulnerable to: GHSA-8jhw-289h-jh2g","Warn: Project is vulnerable to: GHSA-64vr-g452-qvp3","Warn: Project is vulnerable to: GHSA-9cwx-2883-4wfx","Warn: Project is vulnerable to: GHSA-vg6x-rcgg-rjx6","Warn: Project is vulnerable to: GHSA-x574-m823-4x7w","Warn: Project is vulnerable to: GHSA-4r4m-qw57-chr8","Warn: Project is vulnerable to: GHSA-xcj6-pq6g-qj4x","Warn: Project is vulnerable to: GHSA-356w-63v5-8wf4","Warn: Project is vulnerable to: GHSA-859w-5945-r5v3"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:02:54.571Z","repository_id":37010426,"created_at":"2025-08-18T17:02:54.571Z","updated_at":"2025-08-18T17:02:54.571Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38409586,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-20T02:00:06.669Z","response_time":101,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"excalidraw","name":"Excalidraw","uuid":"59452120","kind":"organization","description":"Excalidraw is a whiteboard tool that lets you easily sketch diagrams that have a hand-drawn feel to them.","email":null,"website":"https://excalidraw.com","location":null,"twitter":"excalidraw","company":null,"icon_url":"https://avatars.githubusercontent.com/u/59452120?v=4","repositories_count":26,"last_synced_at":"2026-10-19T08:28:31.503Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/excalidraw","funding_links":[],"total_stars":144160,"followers":3235,"following":0,"created_at":"2022-11-14T06:29:54.791Z","updated_at":"2026-10-19T08:28:31.521Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/excalidraw","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/excalidraw/repositories"},"tags":[{"name":"v0.16.4","sha":"1863da44053dcf95aa4be0891065e8a580002de6","kind":"tag","published_at":"2024-04-17T20:31:23.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.16.4","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.16.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.16.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.16.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.16.4/manifests"},{"name":"v0.17.6","sha":"0dbd2a39319d41fda37b2945dea0dcbd58d6a564","kind":"tag","published_at":"2024-04-17T19:57:47.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.17.6","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.17.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.17.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.17.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.17.6/manifests"},{"name":"v0.16.3","sha":"7ba029807a166571542c434d89e31e5de8708046","kind":"tag","published_at":"2024-04-12T18:19:00.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.16.3","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.16.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.16.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.16.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.16.3/manifests"},{"name":"v0.16.2","sha":"3ae8af5a132e3229999389fbbf043b666a912d9f","kind":"tag","published_at":"2024-04-12T18:16:16.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.16.2","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.16.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.16.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.16.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.16.2/manifests"},{"name":"v0.17.5","sha":"db4770ed8354ab9155f983b244c4a590a36f749c","kind":"tag","published_at":"2024-04-12T18:13:00.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.17.5","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.17.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.17.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.17.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.17.5/manifests"},{"name":"v0.17.4","sha":"640caba73902c94bf2ad08ff1439b6925c5c74e4","kind":"tag","published_at":"2024-04-12T12:58:53.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.17.4","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.17.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.17.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.17.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.17.4/manifests"},{"name":"v0.17.3","sha":"81046ccd6b5d7e81786df6e7c253be4b143fa3fd","kind":"commit","published_at":"2024-02-09T13:31:52.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.17.3","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.17.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.17.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.17.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.17.3/manifests"},{"name":"v0.17.0","sha":"ddb75850573f6fef9a0786ced32ae63ab913f0e0","kind":"commit","published_at":"2023-11-14T14:24:34.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.17.0","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.17.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.17.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.17.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.17.0/manifests"},{"name":"v0.16.1","sha":"f8b3692262e81a33cf16b727ea770b1a5ae0dd38","kind":"commit","published_at":"2023-09-21T04:24:03.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.16.1","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.16.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.16.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.16.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.16.1/manifests"},{"name":"v0.16.0","sha":"0a588a880b972f4e2f15e23bc244cce1c1ff2160","kind":"commit","published_at":"2023-09-19T14:29:53.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.16.0","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.16.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.16.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.16.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.16.0/manifests"},{"name":"v0.15.0","sha":"c9c79646c535dbca2342c5f3de26c24c6aadce19","kind":"commit","published_at":"2023-04-18T15:18:30.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.15.0","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.15.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.15.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.15.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.15.0/manifests"},{"name":"v0.14.2","sha":"f68f4cb9e03d2a24ebfefd57165c41badb81fe14","kind":"commit","published_at":"2023-02-01T13:38:56.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.14.2","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.14.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.14.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.14.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.14.2/manifests"},{"name":"v0.14.1","sha":"d6a5ef19367c366ea9dc15d1f17569d829163828","kind":"commit","published_at":"2023-01-16T10:38:03.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.14.1","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.14.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.14.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.14.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.14.1/manifests"},{"name":"v0.14.0","sha":"c7a11f5cd267dd8703bba4edea5b4ad7f93950e3","kind":"commit","published_at":"2023-01-13T10:38:29.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.14.0","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.14.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.14.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.14.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.14.0/manifests"},{"name":"v0.13.0","sha":"75458c3192de59663aafee6b85c34d5a59f9a255","kind":"commit","published_at":"2022-10-27T12:58:44.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.13.0","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.13.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.13.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.13.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.13.0/manifests"},{"name":"v0.12.0","sha":"fe3d0b5e8b25d1530b5902359fdd21ed99cd3e93","kind":"commit","published_at":"2022-07-07T12:56:19.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.12.0","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.12.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.12.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.12.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.12.0/manifests"},{"name":"v0.11.0","sha":"0896892f8ad03f42d1bd8312fe6bd938f6a3f8aa","kind":"commit","published_at":"2022-02-17T13:22:44.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.11.0","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.11.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.11.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.11.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.11.0/manifests"},{"name":"v0.10.0","sha":"39d45afc060c8a410d07b708a10abaccac9afab3","kind":"commit","published_at":"2021-10-13T11:33:50.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.10.0","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.10.0/manifests"},{"name":"v0.9.0","sha":"8787f3dc60e9f92c1cb850e4750c52d9e608c079","kind":"commit","published_at":"2021-07-10T13:22:19.000Z","download_url":"https://codeload.github.com/excalidraw/excalidraw/tar.gz/v0.9.0","html_url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/excalidraw/excalidraw@v0.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/tags/v0.9.0/manifests"}]},"repo_metadata_updated_at":"2026-10-24T08:17:50.127Z","dependent_packages_count":52,"downloads":2727713,"downloads_period":"last-month","dependent_repos_count":523,"rankings":{"downloads":0.4184373483973393,"dependent_repos_count":0.7404726745527922,"dependent_packages_count":0.5791536085293736,"stargazers_count":0.08388913973157716,"forks_count":0.46482146038247846,"docker_downloads_count":0.6333560025410426,"average":0.4866883723557672},"purl":"pkg:npm/%40excalidraw/excalidraw","advisories":[{"uuid":"GSA_kwCzR0hTQS0zOWg3LXB3djctcmMzeM4ABVxL","url":"https://github.com/advisories/GHSA-39h7-pwv7-rc3x","title":"Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)","description":"### Impact\n\n`@excalidraw/excalidraw@0.18.0` depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.\n\nThis is patched in `@excalidraw/excalidraw@0.18.1` by updating `@excalidraw/mermaid-to-excalidraw` to `2.2.2`, which uses a patched Mermaid 11 release.\n\nModerate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).\n\n### Patches\n\n- Stable `@excalidraw/excalidraw@0.18.1` is patched.\n- Unstable `@excalidraw/excalidraw@next` has resolved to patched builds since `@excalidraw/excalidraw@0.18.0-f29edf` on 2025-08-21.\n- Direct consumers of `@excalidraw/mermaid-to-excalidraw` should use `1.1.3` or later.\n\n### Workarounds\n\nNone.\n\n### Resources\n\n- Upstream Mermaid advisory: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh\n- CVE-2025-54881","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-04-24T20:41:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://github.com/excalidraw/excalidraw/security/advisories/GHSA-39h7-pwv7-rc3x","https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh","https://github.com/excalidraw/excalidraw/releases/tag/v0.18.1","https://github.com/advisories/GHSA-39h7-pwv7-rc3x"],"source_kind":"github","identifiers":["GHSA-39h7-pwv7-rc3x"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-24T21:00:09.011Z","updated_at":"2026-10-22T15:04:22.831Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zOWg3LXB3djctcmMzeM4ABVxL","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zOWg3LXB3djctcmMzeM4ABVxL","packages":[{"ecosystem":"npm","package_name":"@excalidraw/mermaid-to-excalidraw","versions":[{"first_patched_version":"1.1.3","vulnerable_version_range":"\u003e= 0.3.0, \u003c 1.1.3"}],"purl":"pkg:npm/%40excalidraw%2Fmermaid-to-excalidraw"},{"ecosystem":"npm","package_name":"@excalidraw/excalidraw","versions":[{"first_patched_version":"0.18.1","vulnerable_version_range":"= 0.18.0"}],"purl":"pkg:npm/%40excalidraw%2Fexcalidraw"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zOWg3LXB3djctcmMzeM4ABVxL/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tNjRxLTRqcWgtZjcyZs4AA7KT","url":"https://github.com/advisories/GHSA-m64q-4jqh-f72f","title":"Stored Cross-site Scripting (XSS) in excalidraw's web embed component","description":"### Summary\n\nA stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. \n\n### Poc\n\nInserting an embed with the below url (can be copy/pasted onto canvas to insert as embed) will log `42` to the console:\n\n```\nhttps://gist.github.com/vv=v\u003cscript\u003econsole.log(42)\u003c/script\u003e\n```\n\n### Details\n\nThere were two vectors. One rendering untrusted string as iframe's `srcdoc` without properly sanitizing against HTML injection. Second by improperly sanitizing against attribute HTML injection. This in conjunction with allowing `allow-same-origin` sandbox flag (necessary for several embeds) resulted in the XSS.\n\nFormer was fixed by no longer rendering unsafe `srcdoc` content verbatim, and instead strictly parsing the supplied content and constructing the `srcdoc` manually. The latter by sanitizing properly.\n\nThe `allow-same-origin` flag is now also set only in cases that require it, following the principle of least privilege.\n\n### Impact\n\nThis is a cross site scripting vulnerability, for more information, please see: https://portswigger.net/web-security/cross-site-scripting\n\nTwo npm `@excalidraw/excalidraw` stable version releases were affected (`0.16.x`, `0.17.x`), and both are now patched.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-04-17T21:32:57.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":["https://github.com/excalidraw/excalidraw/security/advisories/GHSA-m64q-4jqh-f72f","https://github.com/excalidraw/excalidraw/commit/6be752e1b6d776ccfbd3bb9eea17463cb264121d","https://github.com/excalidraw/excalidraw/commit/988f81911ca58e3ca2583e0dd44a954dd00e09d0","https://nvd.nist.gov/vuln/detail/CVE-2024-32472","https://github.com/advisories/GHSA-m64q-4jqh-f72f"],"source_kind":"github","identifiers":["GHSA-m64q-4jqh-f72f","CVE-2024-32472"],"repository_url":"https://github.com/excalidraw/excalidraw","blast_radius":0.0,"created_at":"2024-04-17T22:04:48.078Z","updated_at":"2026-10-22T15:11:07.282Z","epss_percentage":0.00561,"epss_percentile":0.45529,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tNjRxLTRqcWgtZjcyZs4AA7KT","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tNjRxLTRqcWgtZjcyZs4AA7KT","packages":[{"ecosystem":"npm","package_name":"@excalidraw/excalidraw","versions":[{"first_patched_version":"0.17.6","vulnerable_version_range":"\u003e= 0.17.0, \u003c 0.17.6"},{"first_patched_version":"0.16.4","vulnerable_version_range":"\u003e= 0.16.0, \u003c 0.16.4"}],"purl":"pkg:npm/%40excalidraw%2Fexcalidraw"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tNjRxLTRqcWgtZjcyZs4AA7KT/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12N3Y4LWdqdjctZmZtcs4AA1WK","url":"https://github.com/advisories/GHSA-v7v8-gjv7-ffmr","title":"@excalidraw/excalidraw Cross-site Scripting vulnerability","description":"### Impact\n\nXSS vulnerability due to improperly sanitizing URLs of links that can be attached on canvas elements. This affects users of the npm package `@excalidraw/excalidraw` provided it was deployed in environments where untrusted user input in drawings that are then shared with third parties is a concern. If you only hosted the editor in trusted environments, or sharing didn't take place, the impact is minimized.\n\n### Patches\n\nPatch is available on version 0.15.3 and up (stable), or latest `@excalidraw/excalidraw@next` (unstable releases).\n\n### Workarounds\n\nNo workaround without upgrading unless deployed in environments without untrusted user input.\n\n### References\n\nhttps://security.snyk.io/vuln/SNYK-JS-EXCALIDRAWEXCALIDRAW-5841658\nhttps://github.com/excalidraw/excalidraw/pull/6728","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2023-08-16T21:00:33.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":["https://github.com/excalidraw/excalidraw/security/advisories/GHSA-v7v8-gjv7-ffmr","https://nvd.nist.gov/vuln/detail/CVE-2023-26140","https://github.com/excalidraw/excalidraw/pull/6728","https://github.com/excalidraw/excalidraw/commit/b33fa6d6f64d27adc3a47b25c0aa55711740d0af","https://security.snyk.io/vuln/SNYK-JS-EXCALIDRAWEXCALIDRAW-5841658","https://github.com/advisories/GHSA-v7v8-gjv7-ffmr"],"source_kind":"github","identifiers":["GHSA-v7v8-gjv7-ffmr","CVE-2023-26140"],"repository_url":"https://github.com/excalidraw/excalidraw","blast_radius":0.0,"created_at":"2023-08-16T22:05:00.322Z","updated_at":"2026-10-24T14:12:06.835Z","epss_percentage":0.00561,"epss_percentile":0.4555,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12N3Y4LWdqdjctZmZtcs4AA1WK","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12N3Y4LWdqdjctZmZtcs4AA1WK","packages":[{"ecosystem":"npm","package_name":"@excalidraw/excalidraw","versions":[{"first_patched_version":"0.15.3","vulnerable_version_range":"\u003c 0.15.3"}],"purl":"pkg:npm/%40excalidraw%2Fexcalidraw"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12N3Y4LWdqdjctZmZtcs4AA1WK/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1mcjlnLTJtMmgtYzI3as4AA1VN","url":"https://github.com/advisories/GHSA-fr9g-2m2h-c27j","title":"Duplicate Advisory: @excalidraw/excalidraw Cross-site Scripting vulnerability","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-v7v8-gjv7-ffmr. This link is maintained to preserve external references.\n\n## Original Description\nVersions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objects due to improper input sanitization.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2023-08-16T06:30:24.000Z","withdrawn_at":"2023-08-16T21:00:20.000Z","classification":"GENERAL","cvss_score":6.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2023-26140","https://github.com/excalidraw/excalidraw/pull/6728","https://github.com/excalidraw/excalidraw/commit/b33fa6d6f64d27adc3a47b25c0aa55711740d0af","https://security.snyk.io/vuln/SNYK-JS-EXCALIDRAWEXCALIDRAW-5841658","https://github.com/advisories/GHSA-fr9g-2m2h-c27j"],"source_kind":"github","identifiers":["GHSA-fr9g-2m2h-c27j"],"repository_url":"https://github.com/excalidraw/excalidraw","blast_radius":0.0,"created_at":"2023-08-16T22:05:00.337Z","updated_at":"2026-10-24T14:12:06.835Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mcjlnLTJtMmgtYzI3as4AA1VN","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1mcjlnLTJtMmgtYzI3as4AA1VN","packages":[{"ecosystem":"npm","package_name":"@excalidraw/excalidraw","versions":[{"first_patched_version":"0.15.3","vulnerable_version_range":"\u003c 0.15.3"}],"purl":"pkg:npm/%40excalidraw%2Fexcalidraw"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mcjlnLTJtMmgtYzI3as4AA1VN/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/@excalidraw/excalidraw","docker_dependents_count":15,"docker_downloads_count":80192,"usage_url":"https://repos.ecosyste.ms/usage/npm/@excalidraw/excalidraw","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/@excalidraw/excalidraw/dependencies","status":null,"funding_links":["https://opencollective.com/excalidraw"],"critical":null,"issue_metadata":{"last_synced_at":"2026-10-23T17:03:20.252Z","issues_count":2327,"pull_requests_count":2771,"avg_time_to_close_issue":23462327.35443038,"avg_time_to_close_pull_request":5489436.226133651,"issues_closed_count":789,"pull_requests_closed_count":1675,"pull_request_authors_count":870,"issue_authors_count":1662,"avg_comments_per_issue":2.4881822088525998,"avg_comments_per_pull_request":2.511367737278961,"merged_pull_requests_count":1115,"bot_issues_count":3,"bot_pull_requests_count":83,"past_year_issues_count":231,"past_year_pull_requests_count":645,"past_year_avg_time_to_close_issue":2813648.46875,"past_year_avg_time_to_close_pull_request":4212048.38367347,"past_year_issues_closed_count":32,"past_year_pull_requests_closed_count":245,"past_year_pull_request_authors_count":391,"past_year_issue_authors_count":197,"past_year_avg_comments_per_issue":1.3116883116883118,"past_year_avg_comments_per_pull_request":1.7069767441860464,"past_year_bot_issues_count":1,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":101,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/excalidraw%2Fexcalidraw/issues","maintainers":[{"login":"dwelle","count":608,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/dwelle"},{"login":"Mrazator","count":192,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/Mrazator"},{"login":"mtolmacs","count":189,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/mtolmacs"},{"login":"ad1992","count":174,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/ad1992"},{"login":"zsviczian","count":166,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/zsviczian"},{"login":"ryan-di","count":112,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/ryan-di"},{"login":"DanielJGeiger","count":16,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/DanielJGeiger"},{"login":"excalibot","count":14,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/excalibot"},{"login":"lipis","count":10,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/lipis"},{"login":"Brikaa","count":3,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/Brikaa"},{"login":"pshihn","count":3,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/pshihn"},{"login":"tomayac","count":3,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/tomayac"},{"login":"j-f1","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/j-f1"},{"login":"jaredpalmer","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jaredpalmer"},{"login":"dai-shi","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/dai-shi"},{"login":"petehunt","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/petehunt"},{"login":"arthurtes","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/arthurtes"},{"login":"tamas-excalidraw","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/tamas-excalidraw"},{"login":"Fausto95","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/Fausto95"},{"login":"leandrohstein","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/leandrohstein"},{"login":"xixixao","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/xixixao"}],"active_maintainers":[{"login":"dwelle","count":73,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/dwelle"},{"login":"mtolmacs","count":30,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/mtolmacs"},{"login":"zsviczian","count":8,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/zsviczian"},{"login":"excalibot","count":5,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/excalibot"},{"login":"ryan-di","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/ryan-di"},{"login":"tamas-excalidraw","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/tamas-excalidraw"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@excalidraw%2Fexcalidraw/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@excalidraw%2Fexcalidraw/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@excalidraw%2Fexcalidraw/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@excalidraw%2Fexcalidraw/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@excalidraw%2Fexcalidraw/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@excalidraw%2Fexcalidraw/codemeta","maintainers":[{"uuid":"maielo","login":"maielo","name":null,"email":"maielo.mv@gmail.com","url":null,"packages_count":22,"html_url":"https://www.npmjs.com/~maielo","role":null,"created_at":"2024-08-19T19:56:44.173Z","updated_at":"2024-08-19T19:56:44.173Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/maielo/packages"},{"uuid":"dwelle","login":"dwelle","name":null,"email":"luzar.david@gmail.com","url":null,"packages_count":28,"html_url":"https://www.npmjs.com/~dwelle","role":null,"created_at":"2022-11-16T01:49:28.117Z","updated_at":"2022-11-16T01:49:28.117Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/dwelle/packages"}]}