Skip to content
OpenAdvisories
Critical USN-7353-1 1 CVE

plantuml vulnerability

Published Mar 17, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Tobias S. Fink discovered that PlantUML was susceptible to cross-site
scripting attacks (XSS) in instances where SVG images were rendered.
An attacker could possibly use this issue to cause PlantUML to crash,
resulting in a denial of service, or the execution of arbitrary code.

Fixed packages 5

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS plantuml 1:1.2020.2+ds-1ubuntu0.1
Ubuntu · 24.04 LTS 24.04:LTS plantuml 1:1.2020.2+ds-3ubuntu1.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS plantuml 8024-2ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS plantuml 1:1.2017.15-1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS plantuml 1:1.2018.13+ds-2ubuntu0.1~esm1

Vulnerabilities 1

  • Critical 9.3
    CVE-2022-1231

    XSS via Embedded SVG in SVG Diagram Format in plantuml/plantuml

    XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code exe…

    plantuml plantuml/plantuml plantuml plantuml Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2022-1231