Log in Start free

Vulnerability · Published Jan 16, 2026 · Assigned by snyk

CVE-2026-0858

Medium 6.1

In plain English

A medium-severity cross-site scripting in net.sourceforge.plantuml:plantuml. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.3%top 72.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams. As a result, a crafted PlantUML diagram can inject malicious JavaScript into generated SVG output, leading to arbitrary script execution in the context of applications that render the SVG.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12plantumlno fix listedDEBIAN-CVE-2026-0858
Debian:13plantumlno fix listedDEBIAN-CVE-2026-0858
Debian:14plantumlno fix listedDEBIAN-CVE-2026-0858
Mavennet.sourceforge.plantuml:plantuml1.2026.0GHSA-hrvf-g648-rf3m
Ubuntu:22.04:LTSplantumlno fix listedUBUNTU-CVE-2026-0858
Ubuntu:24.04:LTSplantumlno fix listedUBUNTU-CVE-2026-0858
Ubuntu:25.10plantumlno fix listedUBUNTU-CVE-2026-0858
Ubuntu:26.04:LTSplantumlno fix listedUBUNTU-CVE-2026-0858
Ubuntu:26.10plantumlno fix listedUBUNTU-CVE-2026-0858

Affected products (as reported)

VendorProductVersions
n/a net.sourceforge.plantuml:plantuml 0 – before 1.2026.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P

References