{"id":"CVE-2023-26123","details":"Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does not properly escape the ' character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via emscripten_run_script function.\r\r**Note:** This vulnerability is present only when compiling raylib for PLATFORM_WEB. All the other Desktop/Mobile/Embedded platforms are not affected.","modified":"2026-08-12T13:34:03.822474Z","published":"2023-04-14T05:00:01.188Z","database_specific":{"cna_assigner":"snyk","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26123.json"},"references":[{"type":"WEB","url":"https://github.com/raysan5/raylib/releases/tag/4.5.0"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-UNMANAGED-RAYSAN5RAYLIB-5421188"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26123.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26123"},{"type":"REPORT","url":"https://github.com/raysan5/raylib/issues/2954"},{"type":"FIX","url":"https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/raysan5/raylib","events":[{"introduced":"0"},{"fixed":"fec96137e8d10ee6c88914fbe5e5429c13ee1dac"},{"fixed":"b436c8d7e5346a241b00511a11585936895d959d"}],"database_specific":{"cpe":"cpe:2.3:a:raylib:raylib:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.5.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["4.2.0","4.0.0","3.7.0","3.5.0","3.0.0","2.6.0","2.5.0","2.0.0","1.9.7-dev","1.9.4-dev","1.8.0","1.7.0","1.6.0","1.5.0","1.4.0","1.3.0","1.2.2","1.1.1","1.0.6","1.0.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-26123.json","vanir_signatures_modified":"2026-08-12T13:34:03Z","vanir_signatures":[{"id":"CVE-2023-26123-4e2496b3","signature_type":"Function","signature_version":"v1","source":"https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d","target":{"file":"src/rcore.c","function":"SetClipboardText"},"deprecated":false,"digest":{"function_hash":"41329347419734723558561420860892878095","length":236}},{"signature_version":"v1","source":"https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d","target":{"function":"TakeScreenshot","file":"src/rcore.c"},"deprecated":false,"digest":{"function_hash":"95396039044598347856998703457630442817","length":936},"id":"CVE-2023-26123-537dc9fb","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d","target":{"file":"src/rcore.c","function":"GetClipboardText"},"deprecated":false,"digest":{"function_hash":"110317313863018853267168855357997188970","length":443},"id":"CVE-2023-26123-550b2626"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d","target":{"file":"src/rcore.c","function":"OpenURL"},"deprecated":false,"digest":{"function_hash":"164148737505169253054324280564101103151","length":2054},"id":"CVE-2023-26123-99fbe797"},{"target":{"file":"src/rcore.c"},"deprecated":false,"digest":{"line_hashes":["32934586593772336908919964766218732816","292577221545442391438029834382652359261","12187908305032152799688219310076510328","86207086325609686174765683039731179257","118181487026220434735613591773537399492","231972655437726168945768662483965489761","101042589994435688174658729297630513762","102315135139518680777821178792686834151","223632566967923960062951305016844513338","82460867418613074251510485276858101925","307409158455207886195930030106246530693","251283521399508748766556159128238157277","103526175660519447404867082149257442793","130304515847310512332484270596228411030","38670544352147231526459958535618144686","158392275212931370213822783197556741617","163693579294237792067088239457645805823","158233148284383865134124550249426916381","65436264917782824156953891376843276347","158376806962760377084192736201878689657","70371060100029468243395863517459848280"],"threshold":0.9},"id":"CVE-2023-26123-fc8318f7","signature_type":"Line","signature_version":"v1","source":"https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P"}]}