Skip to content
Fencer Vulns
critical 9.3

CVE-2022-1231 json

XSS via Embedded SVG in SVG Diagram Format in plantuml/plantuml

published 2022-04-15 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-24568

cvss
9.3
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits
0
none known

Summary

XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop applications. Web based applications are the ones most affected. Since the SVG format allows clickable links in diagrams, it is commonly used in plugins for web based projects (like the Confluence plugin, etc. see https://plantuml.com/de/running).

Patch / fix

  • plantuml plantuml/plantuml 1.2022.4
  • plantuml Debian 14, Debian 13 1:1.2020.2+ds-6

debian advisories DEBIAN-CVE-2022-1231

  • plantuml Ubuntu 22.04 LTS 1:1.2020.2+ds-1ubuntu0.1
  • plantuml Ubuntu 24.04 LTS 1:1.2020.2+ds-3ubuntu1.1
  • plantuml Ubuntu Pro 16.04 LTS 8024-2ubuntu0.1~esm1
  • plantuml Ubuntu Pro 18.04 LTS 1:1.2017.15-1ubuntu0.1~esm1
  • plantuml Ubuntu Pro 20.04 LTS 1:1.2018.13+ds-2ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2022-1231

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-1231 updated

plantuml: Stored XSS in the context of the diagram embedder

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.96% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • huntr.dev https://huntr.dev/bounties/27db9509-6cd3-4148-8d70-5942f3837604 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • plantuml plantuml/plantuml

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.