Drawio Desktop
Monthly
draw.io Desktop 31.4.2 and earlier can disclose the contents of arbitrary local files to script running in the app's own file:// origin, because the Electron main-process read handlers (readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, watchFile) never apply the blessed-path authorization that the write handlers enforce. Exploitation is conditional: it requires attacker-controlled script already executing in that origin - per the advisory, a renderer XSS in the drawio webapp reached when a victim opens a malicious diagram - and the readable set is bounded by a content sniff that admits files beginning with '{' or '[' plus known diagram/media formats, or .mmd/.mermaid extensions; the impact is read-only disclosure, with no write, modification, or denial of service. The advisory publishes a PoC of the readFile IPC primitive; it is not verified as working exploit code, and no confirmed active exploitation is reported. Version 31.4.4 contains the vendor-released patch.
draw.io Desktop 31.4.2 and earlier can disclose the contents of arbitrary local files to script running in the app's own file:// origin, because the Electron main-process read handlers (readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, watchFile) never apply the blessed-path authorization that the write handlers enforce. Exploitation is conditional: it requires attacker-controlled script already executing in that origin - per the advisory, a renderer XSS in the drawio webapp reached when a victim opens a malicious diagram - and the readable set is bounded by a content sniff that admits files beginning with '{' or '[' plus known diagram/media formats, or .mmd/.mermaid extensions; the impact is read-only disclosure, with no write, modification, or denial of service. The advisory publishes a PoC of the readFile IPC primitive; it is not verified as working exploit code, and no confirmed active exploitation is reported. Version 31.4.4 contains the vendor-released patch.