GitHub Advisoryadvisory · npm

GHSA-j8r2-2x94-2q67 Cross-Site Scripting in diagram-js-direct-editing

MEDIUM Published 2020-09-11 Modified 2021-09-28 Official page ↗
Ecosystem
npm
Packages
diagram-js-direct-editing
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm diagram-js-direct-editing: < 1.4.3 → fixed in 1.4.3

Description

Versions of `diagram-js-direct-editing` prior to 1.4.3 are vulnerable to Cross-Site Scripting. The package fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.4.3 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References