Vulnerability Description
yWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an XML file in conjunction with a custom stylesheet.
CVSS Score
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Yworks | Yed | < 3.20.1 |
Related Weaknesses (CWE)
References
- https://www.yworks.com/products/yed/downloadRelease NotesVendor Advisory
- https://zigrin.com/advisories/yworks-yed-graph-editor-xslt-remote-code-execution
- https://www.yworks.com/products/yed/downloadRelease NotesVendor Advisory
- https://zigrin.com/advisories/yworks-yed-graph-editor-xslt-remote-code-execution
FAQ
What is CVE-2020-25216?
CVE-2020-25216 is a vulnerability with a CVSS score of 9.8 (CRITICAL). yWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an XML file in conjunction with a custom stylesheet.
How severe is CVE-2020-25216?
CVE-2020-25216 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-25216?
Check the references section above for vendor advisories and patch information. Affected products include: Yworks Yed.