CVE-2025-58172: drawnix XSS Vulnerability

CVE-2025-58172 Overview

CVE-2025-58172 is a cross-site scripting (XSS) vulnerability in Drawnix, an open-source whiteboard tool. The flaw affects Drawnix versions through 0.2.1 and resides in the debug logging functionality. The global function __drawnix__web__console inserts user-controlled content directly into the Document Object Model (DOM) using innerHTML without sanitization. An attacker who can pass untrusted data to the debug logger, for example through a malicious browser extension or another injection vector, can execute arbitrary JavaScript in the application context. The maintainers fixed the issue in version 0.3.0. This vulnerability is categorized under [CWE-79].

Critical Impact
Arbitrary JavaScript execution in the application context, exposing user data and enabling unauthorized actions on behalf of the victim.

Affected Products

Drawnix versions through 0.2.1
apps/web/src/app/app.tsx component in the Drawnix web application
Fixed in Drawnix 0.3.0 and later

Discovery Timeline

2025-09-15 - CVE CVE-2025-58172 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58172

Vulnerability Analysis

Drawnix registers a global helper named __drawnix__web__console on the window object during board initialization. The helper calls addDebugLog(board, value), which writes the supplied string to a DOM element using div.innerHTML = value. Because innerHTML parses the assigned string as HTML, any <script>, <img onerror>, or event-handler payload passed to the logger becomes executable markup.

The function is exposed on the global scope with the explicit intent of being invokable from anywhere in the page. This design choice removes the natural sandbox that a locally scoped debug helper would provide. Any code sharing the origin, including third-party browser extensions or injected scripts, can invoke the logger with attacker-controlled input.

Successful exploitation runs in the same origin as the Drawnix application. The attacker inherits session cookies, local storage, and any authenticated API access the user holds, enabling data theft or unauthorized actions.

Root Cause

The root cause is unsafe DOM sink usage. The addDebugLog helper assigns raw user input to innerHTML without encoding, escaping, or sanitizing the payload. Assigning to textContent or using a sanitizer would have prevented HTML interpretation of the value.

Attack Vector

Exploitation requires that attacker-controlled data reach the global __drawnix__web__console function. Realistic delivery paths include a malicious browser extension calling the function directly, a third-party script loaded into the page, or another injection primitive that can invoke arbitrary window globals. User interaction with a crafted page or extension is typically required.

text

// Source: https://github.com/plait-board/drawnix/commit/92536e63c1adcc509ac51fdd439d4794c8081c58
// Patch in apps/web/src/app/app.tsx — the debug logger registration is commented out
       }}
       afterInit={(board) => {
         console.log('board initialized');
+        /*
         console.log(
           `add __drawnix__web__debug_log to window, so you can call add log anywhere, like: window.__drawnix__web__console('some thing')`
         );
         (window as any)['__drawnix__web__console'] = (value: string) => {
           addDebugLog(board, value);
         };
+        */
       }}
     ></Drawnix>
   );

The patch disables the debug logger registration entirely, removing the global __drawnix__web__console sink that the attacker would target.

Detection Methods for CVE-2025-58172

Indicators of Compromise

Browser console entries showing calls to window.__drawnix__web__console with HTML or JavaScript payloads.
Unexpected DOM nodes injected under the Drawnix debug log container containing <script>, <iframe>, or event-handler attributes such as onerror and onload.
Outbound requests from the Drawnix origin to unfamiliar domains following user interaction with the whiteboard.

Detection Strategies

Perform a source review of deployed Drawnix bundles for the string __drawnix__web__console and confirm the registration is commented out or removed.
Enable a strict Content Security Policy (CSP) that blocks inline scripts and untrusted script-src origins, then monitor CSP violation reports for anomalies.
Inspect installed browser extensions on user endpoints for scripts that reference Drawnix globals or manipulate whiteboard DOM elements.

Monitoring Recommendations

Log and alert on client-side CSP violations originating from the Drawnix application origin.
Track version metadata of deployed Drawnix builds in the software inventory to identify hosts still running 0.2.1 or earlier.
Monitor authenticated session activity for anomalies that could indicate session token theft via injected script.

How to Mitigate CVE-2025-58172

Immediate Actions Required

Upgrade Drawnix to version 0.3.0 or later, which removes the vulnerable debug logger registration.
Audit all self-hosted Drawnix deployments and any downstream forks that reintroduce the __drawnix__web__console global.
Restrict which browser extensions are permitted on endpoints that access Drawnix, particularly in enterprise environments.

Patch Information

The fix is delivered in Drawnix 0.3.0. The maintainers comment out the registration of __drawnix__web__console in apps/web/src/app/app.tsx, eliminating the DOM sink. See the GitHub Security Advisory and the GitHub Commit Changes for details.

Workarounds

No official workarounds exist per the vendor advisory; upgrading to 0.3.0 is the recommended remediation.
If immediate patching is not possible, deploy a strict CSP that disallows inline script execution to reduce exploitability.
Remove the __drawnix__web__console registration block in local builds and rebuild the application from source.

bash

# Upgrade Drawnix to the fixed release
npm install drawnix@^0.3.0
# Verify the installed version
npm ls drawnix