CVE-2026-0858: 
Java vulnerability analysis and mitigation

CVE-2026-0858 is a Stored Cross-Site Scripting (XSS) vulnerability in the PlantUML Java library (net.sourceforge.plantuml:plantuml) affecting all versions before 1.2026.0. The flaw arises from insufficient sanitization of interactive attributes in GraphViz (DOT) diagrams, allowing a crafted PlantUML diagram to inject malicious JavaScript into generated SVG output. It was disclosed by Snyk Security Research (credited to Catalin Iovita) on January 15, 2026, with the vulnerability introduced as of December 23, 2025. The CVSS v3.1 base score is 6.1 (Medium), assigned by Snyk (Snyk Advisory, GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically in the PSystemDot.java class responsible for rendering GraphViz/DOT diagrams to SVG. Prior to the fix, the code attempted to sanitize DOT attributes such as fontname, label, xlabel, URL, href, and tooltip using regex-based filtering, but this sanitization was insufficient to prevent injection of malicious JavaScript through interactive SVG attributes. The fix in commit 6826315 removed SVG export entirely for the PSystemDot (direct DOT) diagram type, eliminating the attack surface rather than attempting to patch the flawed sanitizer (GitHub Commit). Exploitation requires an attacker to supply a crafted DOT diagram to a PlantUML-rendering application, which then generates and serves the malicious SVG to end users.

When a vulnerable application renders attacker-controlled PlantUML diagrams as SVG, the injected JavaScript executes in the victim user's browser context. This can lead to session hijacking, credential theft, malware distribution, or other client-side attacks against users who view the compromised diagrams. Confidentiality and integrity impacts are limited (low) per the CVSS scoring, and there is no direct availability impact; however, the stored nature of the XSS means a single malicious diagram can persistently affect all users who view it (Snyk Advisory, GitHub Advisory).

1. Identify a target application: Find a web application or service that accepts user-supplied PlantUML diagrams and renders them as SVG output (e.g., wikis, documentation platforms, or CI/CD tools using PlantUML versions before 1.2026.0).
2. Craft a malicious DOT diagram: Create a PlantUML diagram using the direct DOT/GraphViz syntax that embeds a malicious JavaScript payload within an interactive attribute such as URL, href, tooltip, or label. For example:

@startdot
digraph G {
  a [URL="javascript:alert(document.cookie)" label="click me"]
}
@enddot

3. Submit the diagram: Upload or submit the crafted diagram to the target application, causing it to be stored and processed by the vulnerable PlantUML library.
4. Trigger SVG generation: The application renders the diagram to SVG, embedding the unsanitized JavaScript payload within SVG attributes (e.g., <a href="javascript:...">).
5. Victim interaction: When another user (or an administrator) views the page containing the rendered SVG, the injected script executes in their browser, enabling session token theft, credential harvesting, or further attacks (Snyk Advisory, GitHub Commit).

• Network: Unexpected outbound requests from users' browsers to attacker-controlled domains after viewing PlantUML-rendered SVG content; unusual POST requests containing cookies or session tokens to external endpoints.
• File System / Application Storage: Stored PlantUML diagram content containing DOT syntax with attributes such as URL, href, tooltip, or label embedding javascript: URIs, <script> tags, or on* event handlers (e.g., onmouseover, onclick).
• Logs: Application logs showing PlantUML diagram submissions containing strings like javascript:, <script, or on[a-z]+= within DOT attribute values; SVG output files containing inline <script> elements or javascript: href values.
• Browser/Client: Unexpected JavaScript execution or network requests triggered when users navigate to pages rendering PlantUML SVG diagrams.

Upgrade net.sourceforge.plantuml:plantuml to version 1.2026.0 or later, which resolves the vulnerability by removing SVG export for the direct DOT (PSystemDot) diagram type entirely (GitHub Release, Snyk Advisory). If immediate patching is not possible, implement server-side input validation to reject or sanitize DOT diagram inputs from untrusted sources, restrict which users can submit PlantUML diagrams, and configure applications to serve SVG output with a Content-Security-Policy header that disables inline script execution (e.g., script-src 'none'). Additionally, consider serving SVG files as downloads or rendering them in sandboxed iframes to limit script execution scope.

The vulnerability was reported by Catalin Iovita of Snyk Security Research and published via the GitHub Advisory Database (GHSA-hrvf-g648-rf3m) and Red Hat's CVE tracker. Coverage appeared on security aggregators including VulnDB, INCIBE-CERT, and Offseq Radar shortly after disclosure (GitHub Advisory, Red Hat CVE). A technical write-up was published at infinitsec.net, and the CVE was noted on Bluesky's CVE feed. Fedora also issued a PlantUML update addressing this issue, indicating downstream Linux distribution uptake.