Cross-Site Scripting in diagram-js
Versions of `diagram-js` prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in `search-pad`, allowing attackers to execute arbitrary JavaScript.RecommendationIf you are using diagram-js 3.x, upgrade to version 3.3.1.
If you are using diagram-js 2.x, upgrade to version 2.6.2.