CVE-2020-25216: 
NixOS vulnerability analysis and mitigation

yWorks yEd Desktop before version 3.20.1 contains a critical vulnerability that allows code execution via an XSL Transformation when using an XML file in conjunction with a custom stylesheet. The vulnerability was discovered and disclosed in September 2020, identified as CVE-2020-25216. This security flaw affects all versions of yEd Desktop prior to 3.20.1 (NVD, Zigrin Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue is related to XML injection (CWE-91) and specifically involves the handling of XSL Transformations in combination with custom stylesheets (NVD).

The vulnerability allows attackers to achieve code execution on the target system, potentially leading to complete system compromise with high impacts on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability can be exploited by providing a specially crafted XML file along with a custom stylesheet to the application. No authentication is required for exploitation, though user interaction may be necessary to open the malicious files (Zigrin Advisory).

The primary mitigation is to upgrade to yEd Desktop version 3.20.1 or later, which contains the fix for this vulnerability. No alternative workarounds have been publicly documented (yWorks Download).