Read the docs
TI-2026-85198 Aliases CVE-2026-115762

Prototype pollution in draw.io GraphML import

Priority LOW 26CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

draw.io before 31.1.5 contains a prototype pollution flaw in its GraphML decoder (mxGraphMlCodec). The decoder accepts attacker-controlled reference keys that address inherited properties such as prototype objects, then assigns attacker-controlled attributes to them (CWE-1321). A remote attacker can supply a malicious GraphML file that, once a user imports it, can lead to script execution in the draw.io origin.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype objects, and the decoder can then assign attacker-controlled attributes to those objects. Importing a malicious GraphML file can trigger client-side prototype pollution. In the advisory-supported cross-site scripting chain, the editor is opened in Trello mode and the user invokes the Trello integration after the import, allowing the polluted state to execute script in the draw.io origin; an existing Trello connection is not required. This vulnerability is fixed in 31.1.5.

Why it matters now

EPSS 0.00167 5th percentileScored 2026-11-07
Fix Fixed drawio (jgraph): 31.1.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
jgraphdrawiobefore 31.1.531.1.5Patch availableCNA
  • drawio Vendorjgraph Affected before 31.1.5 Fixed in 31.1.5 Patch available CNA

Remediation

Update draw.io to version 31.1.5, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA drawio (jgraph) Fixed in 31.1.5

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-115762
  2. 2026-11-06 Priority changed: MEDIUM → LOW

References

Other 2

  • TI-2023-03691 OS Command Injection in jgraph/drawio CVSS 3.1CRITICAL 9.8
  • TI-2023-03690 OS Command Injection in jgraph/drawio CVSS 3.1CRITICAL 9.8
  • TI-2026-53724 draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js CVSS 4.0HIGH 7.7
  • TI-2023-03178 Denial of Service in jgraph/drawio CVSS 3.1HIGH 7.5
  • TI-2026-83372 Search path hijacking in draw.io Desktop on Windows CVSS 3.1HIGH 7.8
  • TI-2023-02834 Cross-site Scripting (XSS) - Stored in jgraph/drawio CVSS 3.1MEDIUM 6.1
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences