CVE-2026-45644: Microsoft Live Share Canvas SDK XSS Flaw

CVE-2026-45644 Overview

CVE-2026-45644 is a cross-site scripting (XSS) vulnerability in the Microsoft Live Share Canvas SDK. The flaw stems from improper neutralization of input during web page generation [CWE-79]. An authorized attacker can exploit the issue to elevate privileges over a network. Exploitation requires user interaction, but attack complexity is low and the attacker only needs low-level privileges to begin.

Microsoft published the advisory through the Microsoft Security Response Center. The vulnerability impacts confidentiality, integrity, and availability of the affected component.

Critical Impact
Successful exploitation allows an authenticated attacker to execute arbitrary script in a victim's browser context and escalate privileges within applications built on the Live Share Canvas SDK.

Affected Products

Microsoft Live Share Canvas SDK
Applications and collaborative experiences built on the Live Share Canvas SDK
Microsoft Teams integrations that embed Live Share Canvas surfaces

Discovery Timeline

2026-06-09 - CVE-2026-45644 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45644

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting flaw in the Microsoft Live Share Canvas SDK. The SDK powers shared, real-time drawing and annotation surfaces in collaborative Microsoft applications. When the SDK renders attacker-controlled content into the page, it fails to neutralize HTML and JavaScript metacharacters. Browsers then execute the injected payload in the security context of the host application.

Because Live Share surfaces are synchronized between participants, an authorized session participant can inject content that other participants render automatically. The attacker abuses an existing session role, then uses the script execution to perform actions reserved for higher-privileged users.

Root Cause

The root cause is improper output encoding when the Canvas SDK serializes user-supplied annotation, label, or shape metadata into the rendered DOM. Input that should be treated as text data is interpreted as active markup. This is a classic [CWE-79] failure to apply context-aware output encoding before insertion into HTML contexts.

Attack Vector

The attacker must already be authorized to participate in a Live Share session. The attacker submits a crafted payload through a shared canvas object, such as a label, ink stroke metadata field, or annotation. When a victim opens or refreshes the shared surface, the SDK renders the malicious markup and the embedded script executes. The attacker then performs privileged actions on behalf of the victim, including state changes within the host application.

No verified public proof-of-concept is available. See the Microsoft CVE-2026-45644 Advisory for vendor-confirmed technical details.

Detection Methods for CVE-2026-45644

Indicators of Compromise

Unexpected <script>, javascript:, or event-handler attributes (onerror, onload) appearing in Live Share Canvas object payloads or telemetry logs.
Anomalous Microsoft Teams or Live Share session events where a low-privileged participant triggers administrative or owner-level actions.
Browser console errors or Content Security Policy violations originating from Live Share Canvas iframes.

Detection Strategies

Inspect Live Share session telemetry for canvas object fields containing HTML control characters such as <, >, or quoted attribute breaks.
Hunt for browser process child activity originating from Teams or Live Share host applications immediately after canvas synchronization events.
Correlate identity provider logs with session participation to identify privilege changes performed shortly after a Live Share session began.

Monitoring Recommendations

Enable Microsoft 365 audit logging for Teams and Live Share collaboration events and forward records to a centralized data lake for retention.
Monitor endpoint browser telemetry for script execution within Teams or Live Share iframes that deviates from baseline behavior.
Alert on changes to tenant or workspace role assignments that occur during or immediately following an active Live Share session.

How to Mitigate CVE-2026-45644

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-45644 Advisory to all applications embedding the Live Share Canvas SDK.
Update the @microsoft/live-share-canvas package dependency to the fixed version published by Microsoft and rebuild affected applications.
Audit recent Live Share sessions for unexpected privilege changes performed by low-privileged participants.

Patch Information

Microsoft has issued guidance through the Microsoft Security Response Center. Developers integrating the Live Share Canvas SDK must update to the patched SDK version and redeploy applications. Refer to the Microsoft CVE-2026-45644 Advisory for the exact fixed version and update steps.

Workarounds

Restrict Live Share session participation to trusted users and disable guest or external participation where business needs allow.
Enforce a strict Content Security Policy on host applications to limit inline script execution within canvas surfaces.
Disable Live Share Canvas features in Teams policies until the SDK update is deployed across all dependent applications.

bash

# Update the Live Share Canvas SDK in affected applications
npm install @microsoft/live-share-canvas@latest
npm audit
npm run build