Volerion logoVolerion
Volerion logoVolerion

PlantUML Stored Cross-Site Scripting Vulnerability in GraphViz Diagrams

Vulnerability

A stored cross-site scripting vulnerability has been identified in PlantUML versions prior to 1.2026.0. This issue arises from inadequate sanitization of interactive attributes within GraphViz diagrams. Consequently, a maliciously crafted PlantUML diagram can embed harmful JavaScript into the resulting SVG output. When this SVG is rendered by applications, it can execute arbitrary scripts, potentially leading to security breaches.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the SVG.

Remediation

Users can upgrade to PlantUML version 1.2026.0 or later to address this vulnerability.

Added: Jan 16, 2026, 5:20 AM
Updated: Jan 16, 2026, 5:20 AM

Vulnerability Rating

Custom Algorithm
spread
2.4
impact
1.7
exploitability
4.0
remediation
7.7
relevance
2.0
threat
6.4
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.