GitHub Advisoryadvisory · npm

GHSA-8fw4-xh83-3j6q Cross-Site Scripting in diagram-js

MEDIUM Published 2020-09-11 Modified 2021-09-28 Official page ↗
Ecosystem
npm
Packages
diagram-js
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm diagram-js: < 2.6.2 → fixed in 2.6.2 • npm diagram-js: >= 3.0.0, < 3.3.1 → fixed in 3.3.1

Description

Versions of `diagram-js` prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in `search-pad`, allowing attackers to execute arbitrary JavaScript. Recommendation If you are using diagram-js 3.x, upgrade to version 3.3.1. If you are using diagram-js 2.x, upgrade to version 2.6.2.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References