net.sourceforge.plantuml vulnerabilities

Products

• net.sourceforge.plantuml/plantuml 2
• net.sourceforge.plantuml/plantuml-mit 2

Latest net.sourceforge.plantuml CVEs

Newest publication first

1. CVE-2026-0858 PlantUML is vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams

   Published 2026-01-16

   Medium·CVSS 5.1 EPSS 0.34%

   Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams. As a result, a crafted PlantUML diagram can inject malicious JavaScript into generated SVG outpu...

2. CVE-2023-3432 Server-Side Request Forgery (SSRF) in plantuml/plantuml

   Published 2023-06-27

   Critical·CVSS 10.0 EPSS 0.87%

   Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9.

3. CVE-2023-3431 Improper Access Control in plantuml/plantuml

   Published 2023-06-27

   Medium·CVSS 5.3 EPSS 0.87%

   Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.