A stored or reflected XSS flaw exists in Excalidraw’s Imported File Handler, where an attacker can manipulate the customData.generationData.html field of an import package to inject malicious script. This weakness maps to CWE-79 (XSS) and CWE-94 (Code Injection). When a compromised file is loaded by a user, the injected code runs with the same privileges as the user’s session, potentially allowing data exfiltration, session hijacking or UI manipulation.

The vulnerability affects Excalidraw versions up to and including 0.18.1. Any installation of the Excalidraw web application or desktop client that has not been upgraded beyond 0.18.1 is potentially at risk.

The CVSS score of 5.3 indicates a moderate severity. Since the exploit is already public, attackers can remotely target users who import crafted files without needing additional credentials. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, but the remote nature of the attack and the lack of vendor response still represent a non-trivial risk, especially in environments where untrusted file imports are allowed.