Skip to content
OpenAdvisories

Vendor

jgraph

37 known vulnerabilities.

Products

jgraph/drawio 26 drawio 9 drawio-desktop 2
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-115762

    draw.io: Prototype pollution in GraphML (mxGraphMlCodec)

    draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype obj…

    jgraph drawio
  • Medium 5.8
    CVE-2026-97373

    draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts

    draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 share…

    jgraph drawio
  • Medium 5.6
    CVE-2026-114606

    draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)

    draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileW…

    jgraph drawio-desktop
  • Medium 4.2
    CVE-2026-63373

    draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection

    draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever IS_GAE is false, which affects se…

    jgraph drawio
  • Medium 6.8
    CVE-2026-63334

    draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist

    draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address…

    jgraph drawio
  • Medium 6.1
    CVE-2026-58504

    draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642

    draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.add…

    jgraph drawio
  • Medium 6.1
    CVE-2026-46642

    draw.io: XSS via crafted cell label when opening a .drawio file

    draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer (which works…

    jgraph drawio
  • Medium 5.3
    CVE-2023-3398

    Denial of Service in jgraph/drawio

    Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.

    jgraph jgraph/drawio
  • Medium 6.5
    CVE-2023-3026

    Cross-site Scripting (XSS) - Stored in jgraph/drawio

    Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.

    jgraph jgraph/drawio
  • Medium 6.5
    CVE-2022-3873

    Cross-site Scripting (XSS) - DOM in jgraph/drawio

    Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.

    jgraph jgraph/drawio jgraph Ubuntu
  • Medium 4.3
    CVE-2022-3223

    Cross-site Scripting (XSS) - Stored in jgraph/drawio

    Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1.

    jgraph jgraph/drawio
  • Medium 4.3
    CVE-2022-3138

    Cross-site Scripting (XSS) - Generic in jgraph/drawio

    Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.

    jgraph jgraph/drawio
  • Medium 5.3
    CVE-2022-3148

    Cross-site Scripting (XSS) - Generic in jgraph/drawio

    Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.

    jgraph jgraph/drawio
  • Medium 5.5
    CVE-2022-3127

    Cross-site Scripting (XSS) - Stored in jgraph/drawio

    Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.

    jgraph jgraph/drawio
  • Medium 5.3
    CVE-2022-3065

    Improper Access Control in jgraph/drawio

    Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.

    jgraph jgraph/drawio
  • Medium 6.1
    CVE-2022-2015

    Cross-site Scripting (XSS) - Stored in jgraph/drawio

    Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.

    jgraph jgraph/drawio
  • Medium 5.3
    CVE-2022-1815

    Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio

    Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.

    jgraph jgraph/drawio
  • Medium 6.3
    CVE-2022-1730

    Cross-site Scripting (XSS) - Stored in jgraph/drawio

    Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4.

    jgraph jgraph/drawio