CVE-2026-0858

LOW EPSS 22.0%
Published Jan 16, 20265mo ago · Modified Jun 17, 20262w ago
2.0 CVSS 4.0
Low
Find Similar
Published Jan 16, 2026 5mo ago
Last Modified Jun 17, 2026 2w ago

Description

Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams. As a result, a crafted PlantUML diagram can inject malicious JavaScript into generated SVG output, leading to arbitrary script execution in the context of applications that render the SVG.

CVSS Details

Base Score
2.0
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction A
Scope X

Threat Intelligence

EPSS Exploit Probability
22.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
plantumlplantuml* <1.2026.0

References 3

  • github.com https://github.com/plantuml/plantuml/commit/6826315db092d2e432aeab1a0894e08017c6e4bd
    Patch
  • github.com https://github.com/plantuml/plantuml/releases/tag/v1.2026.0
    Release Notes
  • security.snyk.io https://security.snyk.io/vuln/SNYK-JAVA-NETSOURCEFORGEPLANTUML-14552230
    PatchVendor Advisory

Remediation

  • github.com https://github.com/plantuml/plantuml/commit/6826315db092d2e432aeab1a0894e08017c6e4bd
    Patch
  • security.snyk.io https://security.snyk.io/vuln/SNYK-JAVA-NETSOURCEFORGEPLANTUML-14552230
    PatchVendor Advisory