Name of the Vulnerable Software and Affected Versions diagram-js versions prior to 3.3.1 diagram-js versions prior to 2.6.2

Description The issue concerns the failure to escape output of user-controlled input in the search-pad, allowing attackers to execute arbitrary JavaScript, which can lead to Cross-Site Scripting.

Recommendations If you are using diagram-js 3.x, upgrade to version 3.3.1. If you are using diagram-js 2.x, upgrade to version 2.6.2.