Description
Versions of `cmmn-js-properties-panel` prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.
## Recommendation
Upgrade to version 0.8.0 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | cmmn-js-properties-panel | < 0.8.0 | 0.8.0 | GHSA-vmh4-322v-cfpc |