Versions of diagram-js prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript.

Recommendation

If you are using diagram-js 3.x, upgrade to version 3.3.1.
If you are using diagram-js 2.x, upgrade to version 2.6.2.

References

• bpmn-io/diagram-js@2565c40
• bpmn-io/diagram-js@777fa06
• https://bpmn.io/blog/posts/2019-html-injection-vulnerabilities-fixed.html