Read the docs
TI-2026-83372 Aliases CVE-2026-119333

Search path hijacking in draw.io Desktop on Windows

Priority HIGH 69CWE-426Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-426.

Summary

draw.io Desktop before 31.5.2 starts powershell and attrib by bare executable name on Windows. Opening a diagram from File Explorer while the app is closed makes its folder the working directory, so a colocated attacker-controlled powershell.bat or attrib.exe runs first (CWE-426). A user who opens a .drawio file from an attacker-supplied archive can run attacker code when Local Fonts is enabled or draft or backup attributes are updated.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00136 3rd percentileScored 2026-11-07
Fix Fixed drawio-desktop (jgraph): 31.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jgraphdrawio-desktopbefore 31.5.231.5.2Patch availableCNA
  • drawio-desktop Vendorjgraph Affected before 31.5.2 Fixed in 31.5.2 Patch available CNA

Remediation

Update draw.io Desktop to version 31.5.2, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA drawio-desktop (jgraph) Fixed in 31.5.2

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119333
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-02 Priority changed: LOW → HIGH

References

Other 3

  • TI-2023-03691 OS Command Injection in jgraph/drawio CVSS 3.1CRITICAL 9.8
  • TI-2023-03690 OS Command Injection in jgraph/drawio CVSS 3.1CRITICAL 9.8
  • TI-2026-53724 draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js CVSS 4.0HIGH 7.7
  • TI-2023-03178 Denial of Service in jgraph/drawio CVSS 3.1HIGH 7.5
  • TI-2023-02834 Cross-site Scripting (XSS) - Stored in jgraph/drawio CVSS 3.1MEDIUM 6.1
  • TI-2022-03550 Cross-site Scripting (XSS) - DOM in jgraph/drawio CVSS 3.1MEDIUM 6.1
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences