PT-2026-3219 · Net.Sourceforge · Plantuml

Catalin Iovita · Publicado 2026-01-16 · Atualizado 2026-02-09 · CVE-2026-0858

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions net.sourceforge.plantuml:plantuml versions prior to 1.2026.0

Description The software is susceptible to a Stored Cross-Site Scripting (XSS) issue because of inadequate sanitization of interactive attributes within GraphViz diagrams. A specially designed PlantUML diagram can inject malicious JavaScript into the generated SVG output, potentially allowing for arbitrary script execution when applications render the SVG.

Recommendations Update to version 1.2026.0 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-0858

GHSA-HRVF-G648-RF3M

Produtos afetados

Plantuml

Referências · 16

• https://github.com/plantuml/plantuml/releases/tag/v1.2026.0 · Nota
• https://github.com/plantuml/plantuml/commit/6826315db092d2e432aeab1a0894e08017c6e4bd · Correção
• https://github.com/plantuml/plantuml · Nota
• https://osv.dev/vulnerability/CVE-2026-0858 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-0858 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-0858 · Aviso do Fabricante
• https://security.snyk.io/vuln/SNYK-JAVA-NETSOURCEFORGEPLANTUML-14552230 · Correção
• https://twitter.com/Cezar_H_Linux/status/2020827248941834495 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-0858 · Nota de Segurança
• https://t.me/cveNotify/150618 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2026-0858 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2012109914739487142 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-hrvf-g648-rf3m · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2012126446844571851 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-0858 · Aviso do Fabricante