Cross-Site Scripting in diagram-js-direct-editing

Description

Versions of diagram-js-direct-editing prior to 1.4.3 are vulnerable to Cross-Site Scripting. The package fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim’s browser.

Recommendation

Update the diagram-js-direct-editing package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.4.3
• Patched version(s): 1.4.3

References

• GHSA-j8r2-2x94-2q67
• www.npmjs.com
• CWE-79
• OWASP 2021-A3

Related Issues

• Cross-Site Scripting in diagram-js - Vulnerability
• Cross-site scripting vulnerability in TinyMCE - tinymce - CVE-2024-21911
• Cross-Site Scripting Vulnerability in @joeattardi/emoji-button - CVE-2021-43785
• RSSHub Cross-site Scripting vulnerability caused by internal media proxy - CVE-2024-27926

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

diagram-js-direct-editing