GHSA-8fw4-xh83-3j6q
Cross-Site Scripting in diagram-js
GHSA-8fw4-xh83-3j6q is a vulnerability with no CVSS score yet in diagram-js, published September 11, 2020. No source lists public exploit code. Fixed in diagram-js 2.6.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.6.2diagram-js +1 more
Description
Versions of diagram-js prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript.
Recommendation
If you are using diagram-js 3.x, upgrade to version 3.3.1. If you are using diagram-js 2.x, upgrade to version 2.6.2.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
diagram-jsnpm | before 2.6.2 | 2.6.2 |
diagram-jsnpm | 3.0.0 up to 3.3.1 | 3.3.1 |
What each source reports
GitHub AdvisoriesNo score
Cross-Site Scripting in diagram-js
Versions of diagram-js prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript.
Recommendation
If you are using diagram-js 3.x, upgrade to version 3.3.1. If you are using diagram-js 2.x, upgrade to version 2.6.2.
- Record
GHSA-8fw4-xh83-3j6q- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-Site Scripting in diagram-js
Versions of diagram-js prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript.
Recommendation
If you are using diagram-js 3.x, upgrade to version 3.3.1. If you are using diagram-js 2.x, upgrade to version 2.6.2.
- Record
GHSA-8fw4-xh83-3j6q- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.