Skip to content
OpenAdvisories

Product · jgraph

drawio

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.7
    CVE-2026-76898

    draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js

    draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and fd00::, but the JDK r…

    jgraph drawio