yWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an XML file in conjunction with a custom stylesheet.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25216
Reference (s):
- https://www.yworks.com/products/yed/download