bpmn-io/diagram-js-direct-editing · Security
Cross-Site Scripting in diagram-js-direct-editing
- GHSA ID
- GHSA-j8r2-2x94-2q67
- Severity
- medium
- Published
- Updated
Description
Versions of diagram-js-direct-editing prior to 1.4.3 are vulnerable to Cross-Site Scripting. The package fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser.
Recommendation
Upgrade to version 1.4.3 or later.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')