Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

mxgraph

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.1npmAmendedPublished

    mxGraph vulnerable to cross-site scripting in color field

    CVE-2019-13127 · GHSA-xm59-jvxm-cp3v

    Affected
    • npm mxgraph <= 4.0.0
    Fixed in
    4.0.1· Vendor fix available
    Issue
    mxGraph through 4.0.0, related to the draw.io Diagrams plugin before 8.3.14 for Confluence and other products, is vulnerable to cross-site scripting. draw.io Diagrams allows the creation and editing of draw.io-based diagrams in Confluence. Among other things, it allows to set the background color of text displayed in the diagram. The color provided by the user is notproperly sanitized, leading to HTML and JavaScript code to be displayed "as it is" to visitors of the page. This allows attackers to execute JavaScript code in the context of the visitor's browser and session and to e.g. run Confluence command under the visitor's user or attack the visitor's browser. Proof of Concept (PoC): 1. Create a new draw.io Diagram, add an element and edit its background color and enter some text to the element 2. Enter the following "color": onMouseOver=alert(1) a= 3. Save and view the resulting diagram, moving your mouse over the text

    Recommended action: Upgrade to 4.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. Critical, CVSS 9.8npmAmendedPublished

    mxGraph vulnerable to XXE attacks

    CVE-2017-18197 · GHSA-wvpv-8524-wg6x

    Affected
    • npm mxgraph < 3.7.6
    Fixed in
    3.7.6· Vendor fix available
    Issue
    In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView.

    Recommended action: Upgrade to 3.7.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →