Cross-Site Scripting in diagram-js

published 2020-09-11 6y ago modified 2021-09-28 5y ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

Versions of `diagram-js` prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in `search-pad`, allowing attackers to execute arbitrary JavaScript.

## Recommendation

If you are using diagram-js 3.x, upgrade to version 3.3.1. If you are using diagram-js 2.x, upgrade to version 2.6.2.

Patch / fix

fixed in 1 links 2

npm diagram-js 2.6.2, 3.3.1

github.com/bpmn-io/diagram-js@2565c40 commit
github.com/bpmn-io/diagram-js@777fa06 commit

Is GHSA-8fw4-xh83-3j6q in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
npm	diagram-js	<2.6.2 >=3.0.0, <3.3.1	2.6.2 3.3.1

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

GitHub Advisory GHSA-8fw4-xh83-3j6q

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.