PT-2020-21153 · Bpmn Io · Diagram-Js

Published 2020-09-11 · Updated 2020-09-11

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions diagram-js versions prior to 3.3.1 diagram-js versions prior to 2.6.2

Description The issue concerns the failure to escape output of user-controlled input in the search-pad, allowing attackers to execute arbitrary JavaScript, which can lead to Cross-Site Scripting.

Recommendations If you are using diagram-js 3.x, upgrade to version 3.3.1. If you are using diagram-js 2.x, upgrade to version 2.6.2.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-8FW4-XH83-3J6Q

Affected Products

Diagram-Js

References · 5

• https://osv.dev/vulnerability/GHSA-8fw4-xh83-3j6q · Vendor Advisory
• https://github.com/bpmn-io/diagram-js/commit/2565c40449379284a55163f290ec812db34244d1 · Note
• https://github.com/bpmn-io/diagram-js · Note
• https://github.com/bpmn-io/diagram-js/commit/777fa06d70036daa9d02f3be6d0732cf4ccd8d6d · Note
• https://bpmn.io/blog/posts/2019-html-injection-vulnerabilities-fixed.html · Note