QwikSec

Security Database

CVE

CWE

Training

CVE-2023-26123

Published: Apr 14, 2023

Modified: Feb 6, 2025

PUBLISHED

CVSS v3.1

6.1

MEDIUM

Description

Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does not properly escape the ' character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via emscripten_run_script function. **Note:** This vulnerability is present only when compiling raylib for PLATFORM_WEB. All the other Desktop/Mobile/Embedded platforms are not affected.

Vendor	Product	Versions
n/a	raysan5/raylib	affected `0 - < 4.5.0`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

References

https://security.snyk.io/vuln/SNYK-UNMANAGED-RAYSAN5RAYLIB-5421188

https://github.com/raysan5/raylib/issues/2954

https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d

https://github.com/raysan5/raylib/releases/tag/4.5.0

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.