GHSA-8fw4-xh83-3j6qMediumDisclosed before NVD

Cross-Site Scripting in diagram-js

Published
September 11, 2020
Last Modified
October 3, 2023

📋 Description

Versions of diagram-js prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript.

Recommendation

If you are using diagram-js 3.x, upgrade to version 3.3.1. If you are using diagram-js 2.x, upgrade to version 2.6.2.

🎯 Affected products2

  • npm/diagram-js:< 2.6.2
  • npm/diagram-js:>= 3.0.0, < 3.3.1

🔗 References (4)