GHSA-vmh4-322v-cfpc
Cross-Site Scripting in cmmn-js-properties-panel
Versions of cmmn-js-properties-panel prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.
Recommendation
Upgrade to version 0.8.0 or later.
What each source reports
GitHub Advisories No score
Cross-Site Scripting in cmmn-js-properties-panel
Versions of cmmn-js-properties-panel prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.
Recommendation
Upgrade to version 0.8.0 or later.
- Record
GHSA-vmh4-322v-cfpc- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross-Site Scripting in cmmn-js-properties-panel
Versions of cmmn-js-properties-panel prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.
Recommendation
Upgrade to version 0.8.0 or later.
- Record
GHSA-vmh4-322v-cfpc- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cmmn-js-properties-panelnpm |
before 0.8.0 | 0.8.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-vmh4-322v-cfpc is a vulnerability with no CVSS score yet in cmmn-js-properties-panel, published September 3, 2020. No source lists public exploit code. Fixed in cmmn-js-properties-panel 0.8.0.