{"action":"Upgrade diagram-js to 2.6.2 or later.","affected":[{"fixed":"2.6.2","introduced":"0"},{"fixed":"3.3.1","introduced":"3.0.0"}],"component":"diagram-js","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2.6.2","3.3.1"],"ghsa_id":"GHSA-8fw4-xh83-3j6q","id":"tcs_01M5KFCRWJBPJ90WXDPFR0ZPD8","modified_at":"2021-09-28T16:58:42Z","published_at":"2020-09-11T21:18:05Z","references":["https://osv.dev/vulnerability/GHSA-8fw4-xh83-3j6q","https://github.com/bpmn-io/diagram-js/commit/2565c40449379284a55163f290ec812db34244d1","https://github.com/bpmn-io/diagram-js/commit/777fa06d70036daa9d02f3be6d0732cf4ccd8d6d","https://bpmn.io/blog/posts/2019-html-injection-vulnerabilities-fixed.html","https://github.com/bpmn-io/diagram-js"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-8fw4-xh83-3j6q","url":"https://osv.dev/vulnerability/GHSA-8fw4-xh83-3j6q"}],"summary":"Cross-Site Scripting in diagram-js"}