~ / search / GHSA-hrvf-g648-rf3m

GHSA-hrvf-g648-rf3m

PlantUML is vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams

Source: GitHub Advisory Database (reviewed) Low CVE-2026-0858

Packages

EcosystemPackageAffectedFixed in
Maven net.sourceforge.plantuml:plantuml < 1.2026.0 1.2026.0

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams. As a result, a crafted PlantUML diagram can inject malicious JavaScript into generated SVG output, leading to arbitrary script execution in the context of applications that render the SVG.

References

External links from the advisory. They lead to third-party sites.