Vulnerabilities

TI-2026-85198 CVE-2026-115762

Prototype pollution in draw.io GraphML import

LOW 26

draw.io is a configurable diagramming and whiteboarding application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00167 Published 2026-11-04 Fixed in 31.1.5 CWE-1321

TI-2026-85183 CVE-2026-97373

Incomplete SSRF blocklist in draw.io proxy allows requests to CGNAT range

LOW 26

draw.io is a configurable diagramming and whiteboarding application.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00244 Published 2026-11-04 Fixed in 30.3.8 CWE-918

TI-2026-83372 CVE-2026-119333

Search path hijacking in draw.io Desktop on Windows

HIGH 69

draw.io Desktop is the official Electron build of draw.io.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00136 Published 2026-10-30 Fixed in 31.5.2 CWE-426

TI-2026-79319 CVE-2026-114606

Arbitrary local file read in draw.io Desktop via IPC handlers

MEDIUM 58

draw.io Desktop is the official Electron build of draw.io.

CVSS 4.0MEDIUM 5.6 Local No auth User interaction EPSS 0.00356 Published 2026-10-22 Fixed in 31.4.4 CWE-200

TI-2026-53724 CVE-2026-76898

draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js

HIGH 73

draw.io is a configurable diagramming and whiteboarding application.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00351 Published 2026-09-21 Fixed in 30.3.8 CWE-918

TI-2026-45176 CVE-2026-63373

draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection

MEDIUM 53

draw.io is a configurable diagramming and whiteboarding application.

CVSS 3.1MEDIUM 4.2 Network No auth User interaction EPSS 0.00153 Published 2026-09-21 Fixed in 30.2.7 CWE-352

TI-2026-45164 CVE-2026-63334

draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist

MEDIUM 63

draw.io is a configurable diagramming and whiteboarding application.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00315 Published 2026-09-21 Fixed in 30.2.7 CWE-367

TI-2026-45197 CVE-2026-63416

draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints

MEDIUM 51

draw.io is a configurable diagramming and whiteboarding application.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00329 Published 2026-09-21 Fixed in 30.2.7 CWE-22

TI-2026-42103 CVE-2026-58504

draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642

MEDIUM 60

draw.io is a configurable diagramming and whiteboarding application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0025 Published 2026-09-21 Fixed in 30.2.5 CWE-116

TI-2026-34293 CVE-2026-46642

draw.io: XSS via crafted cell label when opening a .drawio file

MEDIUM 60

draw.io is a configurable diagramming and whiteboarding application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00221 Published 2026-06-10 Fixed in 29.7.12 CWE-79

TI-2026-30516 CVE-2026-42195

Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host

LOW 16

draw.io is a configurable diagramming and whiteboarding application.

CVSS 3.1LOW 3.4 Network No auth User interaction EPSS 0.00192 Published 2026-05-08 Fixed in 29.7.9 CWE-200

TI-2023-03691 CVE-2023-3975 · GHSA-v966-93rm-v9qx

OS Command Injection in jgraph/drawio

HIGH 76

OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02348 Published 2023-07-27 Fixed in 21.5.0 CWE-78

TI-2023-03690 CVE-2023-3974 · GHSA-2j63-r66v-jwpq

OS Command Injection in jgraph/drawio

HIGH 76

OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01242 Published 2023-07-27 Fixed in 21.4.0 CWE-78

TI-2023-03689 CVE-2023-3973 · GHSA-jgm3-jg5h-p97h

Cross-site Scripting (XSS) - Reflected in jgraph/drawio

MEDIUM 62

Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00396 Published 2023-07-27 Fixed in 21.6.3 CWE-79

TI-2023-03178 CVE-2023-3398 · GHSA-xgp9-53fc-q25j

Denial of Service in jgraph/drawio

HIGH 72

Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00969 Published 2023-06-26 Fixed in 18.1.3 CWE-400

TI-2023-02834 CVE-2023-3026 · GHSA-532w-w73j-36pf

Cross-site Scripting (XSS) - Stored in jgraph/drawio

HIGH 66

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00534 Published 2023-06-01 Fixed in 21.2.8 CWE-79

TI-2022-03550 CVE-2022-3873 · GHSA-whmf-vjx7-5wmv

Cross-site Scripting (XSS) - DOM in jgraph/drawio

HIGH 66

Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00912 Published 2022-11-07 Fixed in 20.5.2 CWE-79

TI-2022-19195 CVE-2022-40440 · GHSA-j4rv-pr9g-q8jv

mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.

LOW 28

mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00713 Published 2022-10-11 No fix listed CWE-79

TI-2022-02978 CVE-2022-3223 · GHSA-qg6w-g8vm-cccf

Cross-site Scripting (XSS) - Stored in jgraph/drawio

LOW 29

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00797 Published 2022-09-16 Fixed in 20.3.1 CWE-79

TI-2022-02892 CVE-2022-3133 · GHSA-gx3f-cvfm-x99m

OS Command Injection in jgraph/drawio

LOW 36

OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01114 Published 2022-09-09 Fixed in 20.3.0 CWE-78

TI-2022-02897 CVE-2022-3138 · GHSA-ch99-86q2-42rq

Cross-site Scripting (XSS) - Generic in jgraph/drawio

LOW 28

Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00677 Published 2022-09-08 Fixed in 20.3.0 CWE-79

TI-2022-02907 CVE-2022-3148 · GHSA-8m5x-34vp-mpvw

Cross-site Scripting (XSS) - Generic in jgraph/drawio

LOW 28

Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00677 Published 2022-09-08 Fixed in 20.3.0 CWE-79

TI-2022-02886 CVE-2022-3127 · GHSA-r26w-7ccx-35wx

Cross-site Scripting (XSS) - Stored in jgraph/drawio

LOW 25

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00646 Published 2022-09-05 Fixed in 20.2.8 CWE-79

TI-2022-02827 CVE-2022-3065 · GHSA-fw5q-8v73-g7c4

Improper Access Control in jgraph/drawio

LOW 36

Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0132 Published 2022-09-02 Fixed in 20.2.8 CWE-284

TI-2022-01868 CVE-2022-2015 · GHSA-6gph-p9m6-46vx

Cross-site Scripting (XSS) - Stored in jgraph/drawio

LOW 25

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00649 Published 2022-06-08 Fixed in 19.0.2 CWE-79

Vulnerabilities

Filters