Jgraph
Monthly
Stored cross-site scripting in draw.io prior to version 29.7.12 allows arbitrary JavaScript execution in the editor's origin when a victim opens a crafted .drawio file. The flaw bypasses the existing label sanitizer entirely because it resides in a separate, unsanitized code path - the Text Format panel's feature-detection routine - which assigns raw cell label content directly to a detached DOM element's innerHTML. Exploitation is automatic upon file import since draw.io selects cells programmatically during that process, requiring no additional user interaction beyond opening the file. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Open redirect in draw.io's GitLab OAuth flow allows an attacker to hijack the authorization popup by supplying a crafted `?gitlab=` URL parameter, replacing the legitimate GitLab server with an attacker-controlled host. All draw.io versions prior to 29.7.9 are affected; users who follow a crafted link and click through the 'Authorize in GitLab' dialog expose their credentials and OAuth state tokens to the attacker's phishing endpoint. No public exploit has been identified and CISA has not listed this in KEV, but the social-engineering barrier is low given draw.io's shareable-URL model.
mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stored cross-site scripting in draw.io prior to version 29.7.12 allows arbitrary JavaScript execution in the editor's origin when a victim opens a crafted .drawio file. The flaw bypasses the existing label sanitizer entirely because it resides in a separate, unsanitized code path - the Text Format panel's feature-detection routine - which assigns raw cell label content directly to a detached DOM element's innerHTML. Exploitation is automatic upon file import since draw.io selects cells programmatically during that process, requiring no additional user interaction beyond opening the file. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Open redirect in draw.io's GitLab OAuth flow allows an attacker to hijack the authorization popup by supplying a crafted `?gitlab=` URL parameter, replacing the legitimate GitLab server with an attacker-controlled host. All draw.io versions prior to 29.7.9 are affected; users who follow a crafted link and click through the 'Authorize in GitLab' dialog expose their credentials and OAuth state tokens to the attacker's phishing endpoint. No public exploit has been identified and CISA has not listed this in KEV, but the social-engineering barrier is low given draw.io's shareable-URL model.
mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.