GitHub Advisoryadvisory · npm

GHSA-vpj4-89q8-rh38 Cross-Site Scripting in bpmn-js-properties-panel

HIGH Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
bpmn-js-properties-panel
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm bpmn-js-properties-panel: < 0.31.0 → fixed in 0.31.0

Description

Versions of `bpmn-js-properties-panel` prior to 0.31.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website. Recommendation Upgrade to version 0.31.0 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References