{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "diagram-js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "diagram-js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:42:58Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Versions of `diagram-js` prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in `search-pad`, allowing attackers to execute arbitrary JavaScript.\n\n\n## Recommendation\n\nIf you are using diagram-js 3.x, upgrade to version 3.3.1.\nIf you are using diagram-js 2.x, upgrade to version 2.6.2.",
  "id": "GHSA-8fw4-xh83-3j6q",
  "modified": "2021-09-28T16:58:42Z",
  "published": "2020-09-11T21:18:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bpmn-io/diagram-js/commit/2565c40449379284a55163f290ec812db34244d1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bpmn-io/diagram-js/commit/777fa06d70036daa9d02f3be6d0732cf4ccd8d6d"
    },
    {
      "type": "WEB",
      "url": "https://bpmn.io/blog/posts/2019-html-injection-vulnerabilities-fixed.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bpmn-io/diagram-js"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Cross-Site Scripting in diagram-js"
}