CVE-2020-36523: XSS in PlantUML 6.43

Successful exploitation of CVE-2020-36523 allows an attacker to inject arbitrary JavaScript code into a PlantUML diagram rendered in a user's browser. This can lead to various malicious outcomes, including session hijacking, defacement of the PlantUML interface, and theft of sensitive information. The impact is particularly concerning in environments where PlantUML diagrams are used to display confidential data or are integrated into critical workflows. Because the vulnerability is triggered remotely, an attacker does not need local access to the PlantUML server to exploit it.

1. Reserved2022-05-27
2. Published2022-06-03
3. Modified2025-04-15
4. EPSS updated2026-04-02

The primary mitigation for CVE-2020-36523 is to upgrade PlantUML to version 6.43.1 or later, which contains the fix. If immediate upgrading is not feasible, consider implementing input validation and sanitization on any user-supplied data used within PlantUML diagrams. While a direct WAF rule is difficult to implement without specific knowledge of the attack vectors, restricting access to the Database Information Macro functionality could reduce the attack surface. After upgrading, verify the fix by attempting to inject a simple JavaScript payload into a PlantUML diagram and confirming that it is not executed.