Kaardeco

**Name of the Vulnerable Software and Affected Versions** Excalidraw versions prior to 0.18.2 **Description** An issue exists in the Imported File Handler component within the `packages/excalidraw/data/restore.ts` file. A remote attacker can perform cross-site scripting (XSS)—a technique used to inject malicious scripts into web pages viewed by other users—by manipulating the `customData.generationData.html` argument. **Recommendations** Update Excalidraw to a version newer than 0.18.1. Restrict the use of the `customData.generationData.html` argument in the Imported File Handler until a patch is applied.