GHSA-8fw4-xh83-3j6q Cross-Site Scripting in diagram-js
Attackers can execute arbitrary JavaScript via unescaped input in search-pad, affecting users of the diagram-js library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-8fw4-xh83-3j6q?
GHSA-8fw4-xh83-3j6q is a cross-site scripting vulnerability in diagram-js, published on 11 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Versions of diagram-js prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript.
Recommendation
If you are using diagram-js 3.x, upgrade to version 3.3.1. If you are using diagram-js 2.x, upgrade to version 2.6.2.
Which versions are affected by GHSA-8fw4-xh83-3j6q?
4 open source packages ship an affected version, including diagram-js.
| Package | Affected | Fixed in |
|---|---|---|
diagram-js npm | All versions | 2.6.2 |
diagram-js npm | All versions | 2.6.2 |
diagram-js npm | From 3.0.0 | 3.3.1 |
diagram-js npm | From 3.0.0 | 3.3.1 |
How do I fix GHSA-8fw4-xh83-3j6q?
Upgrade diagram-js to a fixed version for your release line: 2.6.2 or 3.3.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-8fw4-xh83-3j6q being exploited?
There is no known exploitation of GHSA-8fw4-xh83-3j6q in the wild and no public exploit code.