jgraph Vulnerabilities and Affected Products
Vulnerabilities associated with drawio.
Products
Clear product- jgraph/drawio26 vulnerabilities
- drawio5 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-46642MEDIUM | draw.io: XSS via crafted cell label when opening a .drawio filedraw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer (which works correctly on the rendering path) but in a feature-detection routine in the Text Format panel that reads the raw cell label and assigns it to a detached element's innerHTML without sanitization. Browsers fire onerror for failed image loads e… CWE-79Jun 10, 2026 | CVSS6.1v3.1 | EPSS0.221% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled hostdraw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9. | CVSS3.4v3.1 | EPSS0.192% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2023-3975CRITICAL | OS Command Injection in jgraph/drawioOS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0. CWE-78Jul 27, 2023 | CVSS9.8v3.1 | EPSS2.35% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-3974CRITICAL | OS Command Injection in jgraph/drawioOS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0. CWE-78Jul 27, 2023 | CVSS9.8v3.1 | EPSS1.24% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-3973MEDIUM | Cross-site Scripting (XSS) - Reflected in jgraph/drawioCross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3. CWE-79Jul 27, 2023 | CVSS6.1v3.1 | EPSS0.396% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |