bpmn-io/diagram-js · Security
Cross-Site Scripting in diagram-js
- GHSA ID
- GHSA-8fw4-xh83-3j6q
- Severity
- medium
- Published
- Updated
Description
Versions of diagram-js prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript.
Recommendation
If you are using diagram-js 3.x, upgrade to version 3.3.1. If you are using diagram-js 2.x, upgrade to version 2.6.2.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://github.com/bpmn-io/diagram-js/commit/2565c40449379284a55163f290ec812db34244d1 ↗
- https://github.com/bpmn-io/diagram-js/commit/777fa06d70036daa9d02f3be6d0732cf4ccd8d6d ↗
- https://bpmn.io/blog/posts/2019-html-injection-vulnerabilities-fixed.html ↗
- https://github.com/advisories/GHSA-8fw4-xh83-3j6q ↗