TI-2022-01868 Aliases CVE-2022-2015 GHSA-6gph-p9m6-46vx

Cross-site Scripting (XSS) - Stored in jgraph/drawio

LOW 25CWE-79Published 2022-06-08 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.

Why it matters now

EPSS 0.00649 51st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed jgraph/drawio (jgraph): 19.0.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jgraph	jgraph/drawio	before 19.0.2	19.0.2	Patch available	CNA

jgraph/drawio Vendorjgraph Affected before 19.0.2 Fixed in 19.0.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:diagrams:drawio::::::::	before 19.0.2	Vulnerable	Diagrams

cpe:2.3:a:diagrams:drawio:*:*:*:*:*:*:*:* Versions before 19.0.2 Vulnerable ·Diagrams

Remediation

Fix · CNA jgraph/drawio (jgraph) Fixed in 19.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-06-08
jgraph/drawio 19.0.2
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2022-01867 Code Injection in jgraph/drawioPriority LOW 26
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-2015
2026-10-03 Alias added: GHSA-6gph-p9m6-46vx
2026-10-24 EPSS moved to the 50th–90th percentile

References

Exploit 1

https://huntr.dev/bounties/0d32f448-155c-4b71-9291-9e8bcd522b37

Patch 1

https://github.com/jgraph/drawio/commit/3d3f819d7a04da7d53b37cc0ca4269c157ba2825

TI-2023-03691 OS Command Injection in jgraph/drawio CVSS 3.1CRITICAL 9.8
TI-2023-03690 OS Command Injection in jgraph/drawio CVSS 3.1CRITICAL 9.8
TI-2026-53724 draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js CVSS 4.0HIGH 7.7
TI-2023-03178 Denial of Service in jgraph/drawio CVSS 3.1HIGH 7.5
TI-2026-83372 Search path hijacking in draw.io Desktop on Windows CVSS 3.1HIGH 7.8
TI-2023-02834 Cross-site Scripting (XSS) - Stored in jgraph/drawio CVSS 3.1MEDIUM 6.1

See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences