CVE-2026-0858

Name	CVE-2026-0858
Description	Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams. As a result, a crafted PlantUML diagram can inject malicious JavaScript into generated SVG output, leading to arbitrary script execution in the context of applications that render the SVG.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1125750

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
plantuml (PTS)	bullseye	1:1.2020.2+ds-1	vulnerable
	bookworm	1:1.2020.2+ds-3	vulnerable
	forky, sid, trixie	1:1.2020.2+ds-6	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
plantuml	source	(unstable)	(unfixed)			1125750

Notes

https://security.snyk.io/vuln/SNYK-JAVA-NETSOURCEFORGEPLANTUML-14552230
https://github.com/plantuml/plantuml/commit/6826315db092d2e432aeab1a0894e08017c6e4bd (v1.2026.0)