Skip to content
OpenAdvisories

Vendor

jgraph

37 known vulnerabilities.

Products

jgraph/drawio 26 drawio 9 drawio-desktop 2
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • High 7.8
    CVE-2026-119333

    draw.io Desktop allows Windows executable search-path hijacking

    draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Exp…

    jgraph drawio-desktop
  • High 7.7
    CVE-2026-76898

    draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js

    draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and fd00::, but the JDK r…

    jgraph drawio
  • High 8.3
    CVE-2023-3975

    OS Command Injection in jgraph/drawio

    OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.

    jgraph jgraph/drawio
  • High 7.0
    CVE-2022-3133

    OS Command Injection in jgraph/drawio

    OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.

    jgraph jgraph/drawio
  • High 7.5
    CVE-2022-1784

    Server-Side Request Forgery (SSRF) in jgraph/drawio

    Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.

    jgraph jgraph/drawio
  • High 8.2
    CVE-2022-1774

    Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio

    Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.

    jgraph jgraph/drawio
  • High 7.5
    CVE-2022-1767

    Server-Side Request Forgery (SSRF) in jgraph/drawio

    Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.

    jgraph jgraph/drawio
  • High 8.3
    CVE-2022-1727

    Improper Input Validation in jgraph/drawio

    Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6.

    jgraph jgraph/drawio
  • High 7.5
    CVE-2022-1711

    Server-Side Request Forgery (SSRF) in jgraph/drawio

    Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.

    jgraph jgraph/drawio
  • High 7.5
    CVE-2022-1723

    Server-Side Request Forgery (SSRF) in jgraph/drawio

    Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6.

    jgraph jgraph/drawio
  • High 7.5
    CVE-2022-1713

    SSRF on /proxy in jgraph/drawio

    SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information.

    jgraph jgraph/drawio
  • High 7.5
    CVE-2022-1721

    Path Traversal in WellKnownServlet in jgraph/drawio

    Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application.

    jgraph jgraph/drawio
  • High 7.5
    CVE-2022-1722

    SSRF in editor's proxy via IPv6 link-local address in jgraph/drawio

    SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses

    jgraph jgraph/drawio