Cross-Site Scripting Vulnerability in Drawnix Open-Source Whiteboard Tool

CVE-2025-58172

What is CVE-2025-58172?

Drawnix, an all-in-one open-source whiteboard tool, contains a Cross-Site Scripting vulnerability that arises from improper handling of user-controlled data in its debug logging functionality. In versions up to 0.2.1, the global function |__drawnix__web__console| directly injects user content into the DOM using innerHTML without sanitization. This flaw can potentially enable attackers to execute arbitrary JavaScript by crafting malicious inputs, thereby jeopardizing user data and facilitating unauthorized actions. To mitigate this risk, users are strongly advised to update to version 0.3.0 or later, as no known workarounds exist.

References