CVE-2023-26123 - Vulnerability Details - OpenCVE

Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does not properly escape the ' character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via emscripten_run_script function. **Note:** This vulnerability is present only when compiling raylib for PLATFORM_WEB. All the other Desktop/Mobile/Embedded platforms are not affected.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Raylib	Raylib

Configuration 1 [-]

cpe:2.3:a:raylib:raylib:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d
https://github.com/raysan5/raylib/issues/2954
https://github.com/raysan5/raylib/releases/tag/4.5.0
https://security.snyk.io/vuln/SNYK-UNMANAGED-RAYSAN5RAYLIB-5421188

History

Thu, 06 Feb 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2023-04-14T05:00:01.188Z

Updated: 2025-02-06T20:42:47.318Z

Reserved: 2023-02-20T10:28:48.923Z

Link: CVE-2023-26123

Vulnrichment

Updated: 2024-08-02T11:39:06.852Z

NVD

Status : Modified

Published: 2023-04-14T05:15:13.867

Modified: 2025-02-06T21:15:18.370

Link: CVE-2023-26123

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-26123", "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "state": "PUBLISHED", "assignerShortName": "snyk", "dateReserved": "2023-02-20T10:28:48.923Z", "datePublished": "2023-04-14T05:00:01.188Z", "dateUpdated": "2025-02-06T20:42:47.318Z"}, "containers": {"cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P"}}], "credits": [{"value": "Eugene Lim", "lang": "en"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Cross-site Scripting (XSS)", "lang": "en"}]}], "providerMetadata": {"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk", "dateUpdated": "2023-04-14T05:00:01.188Z"}, "descriptions": [{"value": "Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does not properly escape the ' character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via emscripten_run_script function.\r\r**Note:** This vulnerability is present only when compiling raylib for PLATFORM_WEB. All the other Desktop/Mobile/Embedded platforms are not affected.", "lang": "en"}], "references": [{"url": "https://security.snyk.io/vuln/SNYK-UNMANAGED-RAYSAN5RAYLIB-5421188"}, {"url": "https://github.com/raysan5/raylib/issues/2954"}, {"url": "https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d"}, {"url": "https://github.com/raysan5/raylib/releases/tag/4.5.0"}], "affected": [{"product": "raysan5/raylib", "versions": [{"version": "0", "lessThan": "4.5.0", "status": "affected", "versionType": "semver"}], "vendor": "n/a"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:39:06.852Z"}, "title": "CVE Program Container", "references": [{"url": "https://security.snyk.io/vuln/SNYK-UNMANAGED-RAYSAN5RAYLIB-5421188", "tags": ["x_transferred"]}, {"url": "https://github.com/raysan5/raylib/issues/2954", "tags": ["x_transferred"]}, {"url": "https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d", "tags": ["x_transferred"]}, {"url": "https://github.com/raysan5/raylib/releases/tag/4.5.0", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-06T20:42:43.078446Z", "id": "CVE-2023-26123", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-06T20:42:47.318Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.snyk.io/vuln/SNYK-UNMANAGED-RAYSAN5RAYLIB-5421188", "tags": ["x_transferred"]}, {"url": "https://github.com/raysan5/raylib/issues/2954", "tags": ["x_transferred"]}, {"url": "https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d", "tags": ["x_transferred"]}, {"url": "https://github.com/raysan5/raylib/releases/tag/4.5.0", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:39:06.852Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-26123", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-06T20:42:43.078446Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-06T20:20:53.675Z"}}], "cna": {"credits": [{"lang": "en", "value": "Eugene Lim"}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "n/a", "product": "raysan5/raylib", "versions": [{"status": "affected", "version": "0", "lessThan": "4.5.0", "versionType": "semver"}]}], "references": [{"url": "https://security.snyk.io/vuln/SNYK-UNMANAGED-RAYSAN5RAYLIB-5421188"}, {"url": "https://github.com/raysan5/raylib/issues/2954"}, {"url": "https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d"}, {"url": "https://github.com/raysan5/raylib/releases/tag/4.5.0"}], "descriptions": [{"lang": "en", "value": "Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does not properly escape the ' character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via emscripten_run_script function.\r\r**Note:** This vulnerability is present only when compiling raylib for PLATFORM_WEB. All the other Desktop/Mobile/Embedded platforms are not affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "Cross-site Scripting (XSS)"}]}], "providerMetadata": {"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk", "dateUpdated": "2023-04-14T05:00:01.188Z"}}}, "cveMetadata": {"cveId": "CVE-2023-26123", "state": "PUBLISHED", "dateUpdated": "2025-02-06T20:42:47.318Z", "dateReserved": "2023-02-20T10:28:48.923Z", "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "datePublished": "2023-04-14T05:00:01.188Z", "assignerShortName": "snyk"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:raylib:raylib:*:*:*:*:*:*:*:*", "matchCriteriaId": "CEDAAF81-EA14-4AEF-9C38-FB3063261835", "versionEndExcluding": "4.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does not properly escape the ' character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via emscripten_run_script function.\r\r**Note:** This vulnerability is present only when compiling raylib for PLATFORM_WEB. All the other Desktop/Mobile/Embedded platforms are not affected."}], "id": "CVE-2023-26123", "lastModified": "2025-02-06T21:15:18.370", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-04-14T05:15:13.867", "references": [{"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d"}, {"source": "[email protected]", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/raysan5/raylib/issues/2954"}, {"source": "[email protected]", "tags": ["Release Notes"], "url": "https://github.com/raysan5/raylib/releases/tag/4.5.0"}, {"source": "[email protected]", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://security.snyk.io/vuln/SNYK-UNMANAGED-RAYSAN5RAYLIB-5421188"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/raysan5/raylib/issues/2954"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/raysan5/raylib/releases/tag/4.5.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://security.snyk.io/vuln/SNYK-UNMANAGED-RAYSAN5RAYLIB-5421188"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "[email protected]", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}