CVE-2026-0858 Overview
CVE-2026-0858 is a Stored Cross-Site Scripting (XSS) vulnerability affecting PlantUML versions before 1.2026.0. The vulnerability arises from insufficient sanitization of interactive attributes in GraphViz diagrams. When processing malicious PlantUML diagram input, the application fails to properly sanitize user-controlled content, allowing attackers to inject malicious JavaScript into generated SVG output. This script then executes in the context of any application that renders the tainted SVG.
Critical Impact
Attackers can craft malicious PlantUML diagrams that inject arbitrary JavaScript into SVG output, enabling session hijacking, credential theft, or further client-side attacks against users viewing the rendered diagrams.
Affected Products
- PlantUML (net.sourceforge.plantuml:plantuml) versions prior to 1.2026.0
- Applications and services that render PlantUML-generated SVG output
- Documentation platforms and wikis integrating PlantUML diagram generation
Discovery Timeline
- 2026-01-16 - CVE CVE-2026-0858 published to NVD
- 2026-01-16 - Last updated in NVD database
Technical Details for CVE-2026-0858
Vulnerability Analysis
This Stored XSS vulnerability (CWE-79) exists in PlantUML's GraphViz diagram processing functionality. The core issue stems from the application's failure to properly sanitize interactive SVG attributes when converting PlantUML diagram definitions into SVG output. PlantUML's PSystemDot component, which handles direct GraphViz DOT language processing, allowed SVG export without adequate input filtering.
When a user submits a specially crafted PlantUML diagram containing malicious payloads within GraphViz-specific syntax, the application generates an SVG file that preserves these dangerous elements. Any application that subsequently renders this SVG—whether a web browser, documentation platform, or collaboration tool—will execute the embedded JavaScript in the user's security context.
Root Cause
The vulnerability originates in the PSystemDot class within src/main/java/net/sourceforge/plantuml/directdot/PSystemDot.java. This component processes raw DOT language input for GraphViz diagram generation without implementing proper output encoding or attribute sanitization. The lack of content security filtering on interactive SVG attributes (such as event handlers) permits malicious script content to flow directly into the generated SVG markup.
Attack Vector
An attacker exploits this vulnerability through network-based delivery of a malicious PlantUML diagram. The attack requires user interaction—specifically, a victim must view the rendered SVG output. The attacker crafts a PlantUML diagram containing JavaScript payloads embedded within GraphViz syntax elements. When processed by a vulnerable PlantUML instance, the resulting SVG contains executable script content. Any user or system rendering this SVG will trigger the payload execution.
The attack chain typically involves:
- Attacker submits a malicious PlantUML diagram to a vulnerable service
- PlantUML processes the diagram and generates tainted SVG output
- The SVG is stored or served to other users
- Victims viewing the SVG have malicious JavaScript executed in their browser context
// Security patch removing SVG export capability for PSystemDot
// Source: https://github.com/plantuml/plantuml/commit/6826315db092d2e432aeab1a0894e08017c6e4bd
import java.io.IOException;
import java.io.OutputStream;
import java.util.Arrays;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
import net.atmp.ImageBuilder;
import net.sourceforge.plantuml.AbstractPSystem;
+import net.sourceforge.plantuml.FileFormat;
import net.sourceforge.plantuml.FileFormatOption;
import net.sourceforge.plantuml.FileImageData;
import net.sourceforge.plantuml.StringUtils;
Source: GitHub Commit Update
Detection Methods for CVE-2026-0858
Indicators of Compromise
- Unexpected JavaScript or event handler attributes (onclick, onload, onerror) within PlantUML-generated SVG files
- SVG output containing <script> tags or encoded JavaScript payloads
- Anomalous HTTP requests originating from rendered documentation or diagram pages
- User reports of unexpected browser behavior when viewing PlantUML diagrams
Detection Strategies
- Implement static analysis scanning of PlantUML diagram inputs for suspicious GraphViz attributes and script injection patterns
- Deploy Content Security Policy (CSP) headers on applications serving PlantUML SVG output to detect and block inline script execution
- Monitor web application logs for unusual diagram submission patterns or payloads containing HTML/JavaScript syntax
Monitoring Recommendations
- Enable logging for all PlantUML diagram generation requests with input content hashing for forensic analysis
- Implement real-time alerting for SVG files containing script elements or event handler attributes
- Conduct periodic audits of stored PlantUML diagrams and generated SVG outputs for XSS payloads
- Monitor client-side error logs for CSP violations related to diagram rendering components
How to Mitigate CVE-2026-0858
Immediate Actions Required
- Upgrade PlantUML to version 1.2026.0 or later immediately across all environments
- Audit existing PlantUML-generated SVG files for potential malicious content
- Implement Content Security Policy headers restricting inline script execution for pages rendering PlantUML output
- Review and sanitize any user-submitted PlantUML diagrams stored in your systems
Patch Information
The PlantUML development team addressed this vulnerability in version 1.2026.0. The fix removes SVG export capability for the vulnerable PSystemDot component, eliminating the attack vector. Organizations should update to 1.2026.0 or later via their Maven, Gradle, or direct download mechanisms.
Detailed patch information is available:
Workarounds
- Disable SVG output format for PlantUML diagram generation, using PNG or other raster formats instead
- Implement server-side SVG sanitization before serving PlantUML-generated content to users
- Deploy strict Content Security Policy headers with script-src 'none' for SVG content
- Restrict PlantUML diagram submission to trusted authenticated users only
# Configuration example - Maven dependency update
# Update pom.xml to use patched PlantUML version
<dependency>
<groupId>net.sourceforge.plantuml</groupId>
<artifactId>plantuml</artifactId>
<version>1.2026.0</version>
</dependency>
# For Gradle users, update build.gradle
implementation 'net.sourceforge.plantuml:plantuml:1.2026.0'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
