draw.io CVE-2026-58504

Exploitation requires a victim to open or import an attacker-crafted .drawio file in draw.io prior to version 30.2.5 (UI:R is mandatory - there is no unattended trigger). The malicious file must contain a specific cell structure: an HTML sibling cell that keeps the formatted-label path enabled together with an editable=0 plain-text sibling that is excluded from the merged selection style but remains in the iteration set, so graph.cellRenderer.getLabelValue() returns its label unencoded and mxUtils.canConvertHtmlToSvg() parses it as HTML. No authentication to draw.io is needed by the attacker (PR:N); the attacker only needs to get the crafted file in front of a user. The impact is confined to the draw.io origin's same-origin context (diagram data, browser storage, non-HttpOnly cookies, same-origin actions). What limits real-world risk: required user interaction (opening/importing an untrusted file), affected versions strictly below 30.2.5, and the lack of any host-level or cross-origin impact.

This is a genuine but moderate-severity client-side stored XSS (CWE-79) with a vendor CVSS of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and my independent assessment agrees closely. The decisive limiting factor is UI:R - exploitation requires the victim to open or import an attacker-crafted .drawio file; there is no path to purely remote, no-interaction compromise. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public POC is referenced, so exploitation status is: no public exploit identified at time of analysis. The impact is bounded (C:L/I:L/A:N - script runs in the draw.io origin, exposing diagram data, browser storage, non-HttpOnly cookies, and same-origin actions, but not full account/host takeover). Notably, this bypasses the earlier CVE-2026-46642 remediation, which signals that this code path (label rendering of editable=0 plain-text siblings) has attacker interest and prior scrutiny - an incomplete-fix pattern that raises the practical likelihood of a working exploit being developed. Overall this is a real 'patch promptly' issue for organizations that render untrusted .drawio files, but not an emergency network-facing RCE; the single most important signal (UI:R, no KEV, no POC) argues for routine rather than crisis prioritization.

An attacker crafts a malicious .drawio diagram containing an HTML sibling cell alongside an editable=0 plain-text sibling whose unencoded label is parsed as HTML by mxUtils.canConvertHtmlToSvg(). The attacker shares or emails this file (or embeds it in a wiki/repo), and when a victim opens or imports it in a vulnerable draw.io (<30.2.5), attacker-controlled JavaScript executes in the draw.io origin, exposing diagram data, browser storage, non-HttpOnly cookies, and same-origin actions. No public POC is referenced, but the flaw is a documented bypass of the prior CVE-2026-46642 fix.