GHSA-vpj4-89q8-rh38
Cross-Site Scripting in bpmn-js-properties-panel
Versions of bpmn-js-properties-panel prior to 0.31.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.
Recommendation
Upgrade to version 0.31.0 or later.
What each source reports
GitHub AdvisoriesNo score
Cross-Site Scripting in bpmn-js-properties-panel
Versions of bpmn-js-properties-panel prior to 0.31.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.
Recommendation
Upgrade to version 0.31.0 or later.
- Record
GHSA-vpj4-89q8-rh38- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-Site Scripting in bpmn-js-properties-panel
Versions of bpmn-js-properties-panel prior to 0.31.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.
Recommendation
Upgrade to version 0.31.0 or later.
- Record
GHSA-vpj4-89q8-rh38- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bpmn-js-properties-panelnpm | before 0.31.0 | 0.31.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-vpj4-89q8-rh38 is a vulnerability with no CVSS score yet in bpmn-js-properties-panel, published September 3, 2020. No source lists public exploit code. Fixed in bpmn-js-properties-panel 0.31.0.