This vulnerability (CVE-2026-45644) in Microsoft Live Share Canvas SDK version 1.0.0 is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, or Cross-site Scripting). It allows an attacker with some level of authorization to execute malicious scripts by injecting unsafe input into web pages generated by the SDK. This can lead to privilege escalation over a network. The CVSS 3.1 base score is 8.0, indicating high severity, with attack vector network, low attack complexity, required privileges low, user interaction required, and high impact on confidentiality, integrity, and availability. Microsoft has released an official fix for this vulnerability.

An authorized attacker can exploit this XSS vulnerability to execute arbitrary scripts in the context of the affected application, potentially leading to privilege escalation and full compromise of confidentiality, integrity, and availability of the system using Microsoft Live Share Canvas SDK version 1.0.0.

An official fix is available from Microsoft. Users of Microsoft Live Share Canvas SDK version 1.0.0 should apply the vendor-provided patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45644. No additional mitigation steps are indicated beyond applying the official fix.