{"id":"GHSA-8fw4-xh83-3j6q","aliases":[],"status":"published","title":"Cross-Site Scripting in diagram-js","description":"Versions of `diagram-js` prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in `search-pad`, allowing attackers to execute arbitrary JavaScript.\n\n\n## Recommendation\n\nIf you are using diagram-js 3.x, upgrade to version 3.3.1.\nIf you are using diagram-js 2.x, upgrade to version 2.6.2.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-09-11T21:18:05Z","modified":"2023-10-03T13:43:33Z","fixes":[{"ecosystem":"npm","package":"diagram-js","fixed_in":["2.6.2","3.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"diagram-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"diagram-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.1"}]}]},{"source":"osv","ecosystem":"npm","package":"diagram-js","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.2"}]}]},{"source":"osv","ecosystem":"npm","package":"diagram-js","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.3.1"}]}]}],"references":[{"url":"https://github.com/bpmn-io/diagram-js/commit/2565c40449379284a55163f290ec812db34244d1","tags":["web"]},{"url":"https://github.com/bpmn-io/diagram-js/commit/777fa06d70036daa9d02f3be6d0732cf4ccd8d6d","tags":["web"]},{"url":"https://bpmn.io/blog/posts/2019-html-injection-vulnerabilities-fixed.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8fw4-xh83-3j6q"},{"url":"https://github.com/bpmn-io/diagram-js","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-8fw4-xh83-3j6q","title":"Cross-Site Scripting in diagram-js","description":"Versions of `diagram-js` prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in `search-pad`, allowing attackers to execute arbitrary JavaScript.\n\n\n## Recommendation\n\nIf you are using diagram-js 3.x, upgrade to version 3.3.1.\nIf you are using diagram-js 2.x, upgrade to version 2.6.2.","status":"published","published":"2020-09-11T21:18:05Z","modified":"2023-10-03T13:43:33Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:07.641671Z"}],"osv":[{"id":"GHSA-8fw4-xh83-3j6q","title":"Cross-Site Scripting in diagram-js","description":"Versions of `diagram-js` prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in `search-pad`, allowing attackers to execute arbitrary JavaScript.\n\n\n## Recommendation\n\nIf you are using diagram-js 3.x, upgrade to version 3.3.1.\nIf you are using diagram-js 2.x, upgrade to version 2.6.2.","status":"published","published":"2020-09-11T21:18:05Z","modified":"2021-09-28T16:58:42Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:42.437513Z"}]}}