The vulnerability is a stored cross‑site scripting flaw that originates from insufficient sanitization of interactive attributes in GraphViz diagrams produced by PlantUML. A maliciously crafted diagram can inject JavaScript into the resulting SVG, which then executes with the privileges of any application that renders the SVG. This is an input validation weakness, classified as CWE‑79.

PlantUML (net.sourceforge.plantuml:plantuml) versions older than 1.2026.0 are affected. Clients that generate or display GraphViz diagrams with these older versions can be exploited.

The CVSS score of 5.1 indicates moderate risk, while the EPSS score of less than 1 % shows a very low probability of exploitation, and it is not listed in the CISA KEV catalog. Exploitation requires that an attacker supply a PlantUML diagram that the application stores and later renders as SVG; the injected script runs in the context of the rendering application or the user's session, potentially enabling data theft or session hijacking. Attackers with the ability to influence the content rendered by the vulnerable application are the primary threat actors.