jgraph

Records40All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high13CVSS 7.0–8.9

Exploited now

jgraph records in CISA KEV

No jgraph vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Mxgraph 3 records MEDIUM

Records

40 records

TI-2023-03691 CVE-2023-3975 · GHSA-v966-93rm-v9qx

OS Command Injection in jgraph/drawio

HIGH 76

OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02348 Published 2023-07-27 Fixed in 21.5.0 CWE-78

TI-2023-03690 CVE-2023-3974 · GHSA-2j63-r66v-jwpq

OS Command Injection in jgraph/drawio

HIGH 76

OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01242 Published 2023-07-27 Fixed in 21.4.0 CWE-78

TI-2026-53724 CVE-2026-76898

draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js

HIGH 73

draw.io is a configurable diagramming and whiteboarding application.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00351 Published 2026-09-21 Fixed in 30.3.8 CWE-918

TI-2023-03178 CVE-2023-3398 · GHSA-xgp9-53fc-q25j

Denial of Service in jgraph/drawio

HIGH 72

Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00969 Published 2023-06-26 Fixed in 18.1.3 CWE-400

TI-2026-83372 CVE-2026-119333

Search path hijacking in draw.io Desktop on Windows

HIGH 69

draw.io Desktop is the official Electron build of draw.io.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00136 Published 2026-10-30 Fixed in 31.5.2 CWE-426

TI-2023-02834 CVE-2023-3026 · GHSA-532w-w73j-36pf

Cross-site Scripting (XSS) - Stored in jgraph/drawio

HIGH 66

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00534 Published 2023-06-01 Fixed in 21.2.8 CWE-79

TI-2022-03550 CVE-2022-3873 · GHSA-whmf-vjx7-5wmv

Cross-site Scripting (XSS) - DOM in jgraph/drawio

HIGH 66

Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00912 Published 2022-11-07 Fixed in 20.5.2 CWE-79

TI-2026-45164 CVE-2026-63334

draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist

MEDIUM 63

draw.io is a configurable diagramming and whiteboarding application.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00315 Published 2026-09-21 Fixed in 30.2.7 CWE-367

TI-2023-03689 CVE-2023-3973 · GHSA-jgm3-jg5h-p97h

Cross-site Scripting (XSS) - Reflected in jgraph/drawio

MEDIUM 62

Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00396 Published 2023-07-27 Fixed in 21.6.3 CWE-79

TI-2026-42103 CVE-2026-58504

draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642

MEDIUM 60

draw.io is a configurable diagramming and whiteboarding application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0025 Published 2026-09-21 Fixed in 30.2.5 CWE-116

TI-2026-34293 CVE-2026-46642

draw.io: XSS via crafted cell label when opening a .drawio file

MEDIUM 60

draw.io is a configurable diagramming and whiteboarding application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00221 Published 2026-06-10 Fixed in 29.7.12 CWE-79

TI-2026-79319 CVE-2026-114606

Arbitrary local file read in draw.io Desktop via IPC handlers

MEDIUM 58

draw.io Desktop is the official Electron build of draw.io.

CVSS 4.0MEDIUM 5.6 Local No auth User interaction EPSS 0.00356 Published 2026-10-22 Fixed in 31.4.4 CWE-200

TI-2026-45176 CVE-2026-63373

draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection

MEDIUM 53

draw.io is a configurable diagramming and whiteboarding application.

CVSS 3.1MEDIUM 4.2 Network No auth User interaction EPSS 0.00153 Published 2026-09-21 Fixed in 30.2.7 CWE-352

TI-2026-45197 CVE-2026-63416

draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints

MEDIUM 51

draw.io is a configurable diagramming and whiteboarding application.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00329 Published 2026-09-21 Fixed in 30.2.7 CWE-22

TI-2017-13382 CVE-2017-18197 · GHSA-wvpv-8524-wg6x

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in…

MEDIUM 47

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02899 Published 2018-02-24 Partial fix · 3.7.6 CWE-611

TI-2022-01446 CVE-2022-1575 · GHSA-h3vj-c927-89ww

Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio

MEDIUM 46

Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.02397 Published 2022-05-05 Fixed in 18.0.0 CWE-94

TI-2022-01579 CVE-2022-1713 · GHSA-5f4w-gff5-9w6x

SSRF on /proxy in jgraph/drawio

MEDIUM 45

SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.09581 Published 2022-05-16 Fixed in 18.0.4 CWE-918

TI-2022-01577 CVE-2022-1711 · GHSA-c9xr-h75p-wmh5

Server-Side Request Forgery (SSRF) in jgraph/drawio

MEDIUM 42

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05795 Published 2022-05-17 Fixed in 18.0.5 CWE-918

TI-2022-01681 CVE-2022-1815 · GHSA-x424-j55f-6xv3

Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio

MEDIUM 41

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05389 Published 2022-05-25 Fixed in 18.1.2 CWE-200

TI-2022-01593 CVE-2022-1727 · GHSA-v54h-972g-3845

Improper Input Validation in jgraph/drawio

MEDIUM 41

Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01407 Published 2022-05-18 Fixed in 18.0.6 CWE-20

TI-2022-01587 CVE-2022-1721 · GHSA-38xh-rw88-j2v8

Path Traversal in WellKnownServlet in jgraph/drawio

LOW 37

Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02273 Published 2022-05-16 Fixed in 18.0.5 CWE-22

TI-2022-02892 CVE-2022-3133 · GHSA-gx3f-cvfm-x99m

OS Command Injection in jgraph/drawio

LOW 36

OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01114 Published 2022-09-09 Fixed in 20.3.0 CWE-78

TI-2022-02827 CVE-2022-3065 · GHSA-fw5q-8v73-g7c4

Improper Access Control in jgraph/drawio

LOW 36

Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0132 Published 2022-09-02 Fixed in 20.2.8 CWE-284

TI-2022-01650 CVE-2022-1784 · GHSA-mx52-g499-r9jm

Server-Side Request Forgery (SSRF) in jgraph/drawio

LOW 36

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01798 Published 2022-05-20 Fixed in 18.0.8 CWE-918

TI-2022-01633 CVE-2022-1767 · GHSA-f4qm-wpp3-7v77

Server-Side Request Forgery (SSRF) in jgraph/drawio

LOW 36

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0181 Published 2022-05-18 Fixed in 18.0.7 CWE-918

Open these records in search →

Critical	4
High	13
Medium	20
Low	3
No CVSS	0