Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Check for stored XSS vulnerability in draw.io < 18.0.0 #110

Open
davidjgraph opened this issue May 5, 2022 · 0 comments
Open

Check for stored XSS vulnerability in draw.io < 18.0.0 #110

davidjgraph opened this issue May 5, 2022 · 0 comments

Comments

@davidjgraph
Copy link

Versions of draw.io prior to 18.0.0 are susceptible to the stored XSS attack described at https://huntr.dev/bounties/033d3423-eb05-4b53-a747-1bfcba873127/ if they do not have an appropriate CSP to block unsafe-inline script.

I don't know if this project bundles draw.io, but if it does I would test against the test case and update to 18.0.0 is found to be susceptible.
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@davidjgraph