PT-2026-3219 · Net.Sourceforge · Plantuml

Catalin Iovita · Published 2026-01-16 · Updated 2026-02-09 · CVE-2026-0858

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions net.sourceforge.plantuml:plantuml versions prior to 1.2026.0

Description The software is susceptible to a Stored Cross-Site Scripting (XSS) issue because of inadequate sanitization of interactive attributes within GraphViz diagrams. A specially designed PlantUML diagram can inject malicious JavaScript into the generated SVG output, potentially allowing for arbitrary script execution when applications render the SVG.

Recommendations Update to version 1.2026.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-0858

GHSA-HRVF-G648-RF3M

Affected Products

Plantuml

References · 16

• https://github.com/plantuml/plantuml/commit/6826315db092d2e432aeab1a0894e08017c6e4bd · Patch
• https://osv.dev/vulnerability/CVE-2026-0858 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-0858 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-0858 · Vendor Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-NETSOURCEFORGEPLANTUML-14552230 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-0858 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-0858 · Security Note
• https://osv.dev/vulnerability/GHSA-hrvf-g648-rf3m · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-0858 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-0858 · Vendor Advisory
• https://github.com/plantuml/plantuml/releases/tag/v1.2026.0 · Note
• https://github.com/plantuml/plantuml · Note
• https://twitter.com/Cezar_H_Linux/status/2020827248941834495 · Twitter Post
• https://t.me/cveNotify/150618 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2012109914739487142 · Twitter Post