CVE-2026-45644: Microsoft Live Share Canvas SDK Elevation of Privilege Vulnerability

Synopsis

A stored or reflected cross-site scripting (XSS) vulnerability exists in the Microsoft Live Share Canvas SDK, affecting versions 1.0.0 through 1.4.1. The flaw is reachable over the network and requires a low-privilege account plus a victim taking some action, such as viewing or interacting with attacker-controlled canvas content. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability in the affected session, effectively elevating their privileges. A patched-image rebuild at version 1.4.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable service over the network; there is no local or physical access requirement.

• AuthenticationRequired

  A low-privilege authenticated account is sufficient; the attacker does not need administrative credentials.

• Victim interactionRequired

  A victim must take some action, such as loading or interacting with attacker-controlled canvas content, for the exploit to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental configurations.

Blast Radius

• A successful attacker reads sensitive data accessible in the victim's session context, such as session tokens or shared canvas content.
• The attacker modifies data or injects persistent content within the victim's session, potentially affecting other users who view the same canvas.
• The attacker can disrupt availability of the affected session or canvas workspace, preventing legitimate access.
• Privilege escalation means the attacker operates with permissions beyond their original low-privilege account, expanding the scope of any follow-on actions.