Skip to content
OpenAdvisories

Product · jgraph

drawio-desktop

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.6
    CVE-2026-114606

    draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)

    draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileW…

    jgraph drawio-desktop