Executive brief
dmn-js-properties-panel is a JavaScript library used to build property panels for DMN (Decision Model and Notation) diagram editors. Versions before 0.3.0 fail to sanitize input in specially configured diagrams, allowing attackers to inject malicious JavaScript code that executes in the context of websites embedding this component, potentially compromising user sessions or stealing sensitive data.
Technical details
This is a Cross-Site Scripting (XSS) vulnerability (CWE-79) in dmn-js-properties-panel. The root cause is insufficient input sanitization in diagram processing, which allows attackers to inject arbitrary JavaScript through specially crafted diagram configurations. The attack vector is network-based and does not require authentication, but depends on a user interacting with a malicious or compromised diagram in an application that embeds this library. An attacker can execute arbitrary JavaScript in the victim's browser within the security context of the embedding website. The fix is to upgrade to version 0.3.0 or later, which implements proper input sanitization.
Affected products
- bpmn-io dmn-js-properties-panel all versions before 0.3.0
Timeline
- 2020-09-03: disclosed