Jgraph
Monthly
Server-side request forgery in self-hosted draw.io (jgraph/drawio) prior to 30.3.8 lets an unauthenticated remote attacker point the /embed2.js?fetch= endpoint at internal IPv6 Unique Local Address (ULA) resources and read the reflected response, including AWS instance metadata served on the fd00:ec2::/32 range, which can expose IAM credentials and other sensitive internal data. The flaw is a filter bypass rather than a missing check: the private-address guard compared the JDK's fully expanded IPv6 text form against the compressed prefixes 'fc00::' and 'fd00::', so the entire fc00::/7 ULA space slipped through. Exploitation requires a reachable self-hosted draw.io instance and an internal target genuinely addressable over IPv6 ULA - IPv4 private ranges remain blocked, and neither authentication nor the ENABLE_DRAWIO_PROXY=1 flag nor DNS rebinding is needed on the primary /embed2.js path. No public exploit code was identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing); the CVSS 4.0 base score is 7.7 (High), reflecting a network-vector, scope-changing confidentiality impact.
draw.io Desktop 31.4.2 and earlier can disclose the contents of arbitrary local files to script running in the app's own file:// origin, because the Electron main-process read handlers (readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, watchFile) never apply the blessed-path authorization that the write handlers enforce. Exploitation is conditional: it requires attacker-controlled script already executing in that origin - per the advisory, a renderer XSS in the drawio webapp reached when a victim opens a malicious diagram - and the readable set is bounded by a content sniff that admits files beginning with '{' or '[' plus known diagram/media formats, or .mmd/.mermaid extensions; the impact is read-only disclosure, with no write, modification, or denial of service. The advisory publishes a PoC of the readFile IPC primitive; it is not verified as working exploit code, and no confirmed active exploitation is reported. Version 31.4.4 contains the vendor-released patch.
Self-hosted draw.io deployments running the Docker or WAR build prior to 30.2.7 can have a victim's browser session silently bound to the attacker's own cloud-storage identity, because the OAuth callback handler skips verification of the state token against the session cookie whenever IS_GAE is false. An attacker who completes a legitimate authorization for their own account can then induce a victim to open a crafted callback URL, causing subsequent Google Drive, OneDrive, GitHub, GitLab, or Dropbox actions to be performed under the attacker's identity (CVSS 4.2, CVSS:3.1/AV:N/AC:H/PR:N/UI:R, CWE-352); the impact is session integrity loss and misattribution rather than disclosure of the victim's existing cloud files, and no public exploit identified at time of analysis. The hosted SaaS at app.diagrams.net and any Google App Engine build set IS_GAE=true and are unaffected.
Server-side request forgery in self-hosted draw.io deployments prior to 30.2.7 allows unauthenticated remote attackers to make the server fetch attacker-chosen URLs that resolve to private, link-local, or cloud-metadata addresses, returning internal HTTP responses or instance metadata through the image proxy. The flaw only exists when the server is started with ENABLE_DRAWIO_PROXY=1; the SaaS and desktop editions and default installs are unaffected. Successful exploitation depends on a DNS-rebinding timing race (the hostname must resolve to a public address during validation and to an internal address at connection time), which is why the assessed severity is 6.8 with AC:H rather than a high-severity rating; there is no public exploit code identified at time of analysis and the issue is not in CISA KEV. Vendor-released patch: 30.2.7.
Path traversal in the self-hosted draw.io server (jgraph/drawio) before version 30.2.7 allows unauthenticated remote attackers to redirect the ExportProxyServlet's internal proxy request to unintended routes on the configured export backend by supplying dot segments (literal or percent-encoded) in the request path. Because the servlet copies all request headers and the request body to the traversed destination, an attacker can reach administration, debugging, health, or configuration endpoints that the export server happens to expose, and may trigger unintended internal actions, though the practical impact is bounded by how that backend is configured. Exploitation requires a deployment that has the export proxy feature enabled and pointed at an internal export service; there is no public exploit identified at time of analysis, and no EPSS score was supplied, so the vendor's modest CVSS of 3.7 is a reasonable reflection of real-world risk.
Stored cross-site scripting in draw.io (jgraph/drawio) versions prior to 30.2.5 lets an attacker-crafted .drawio diagram execute JavaScript in the draw.io origin once a victim opens or imports the file and selects the affected cells. The payload survives the earlier CVE-2026-46642 remediation because an HTML sibling cell keeps the formatted-label path enabled while an editable=0 plain-text sibling is excluded from the merged selection style yet remains in the iteration set, so graph.cellRenderer.getLabelValue() returns the label unencoded and mxUtils.canConvertHtmlToSvg() then parses it as HTML. Successful exploitation exposes diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim; exploitation requires user interaction (opening or importing an untrusted file) and no public exploit code has been identified at time of analysis, with a vendor CVSS of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Stored cross-site scripting in draw.io prior to version 29.7.12 allows arbitrary JavaScript execution in the editor's origin when a victim opens a crafted .drawio file. The flaw bypasses the existing label sanitizer entirely because it resides in a separate, unsanitized code path - the Text Format panel's feature-detection routine - which assigns raw cell label content directly to a detached DOM element's innerHTML. Exploitation is automatic upon file import since draw.io selects cells programmatically during that process, requiring no additional user interaction beyond opening the file. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Open redirect in draw.io's GitLab OAuth flow allows an attacker to hijack the authorization popup by supplying a crafted `?gitlab=` URL parameter, replacing the legitimate GitLab server with an attacker-controlled host. All draw.io versions prior to 29.7.9 are affected; users who follow a crafted link and click through the 'Authorize in GitLab' dialog expose their credentials and OAuth state tokens to the attacker's phishing endpoint. No public exploit has been identified and CISA has not listed this in KEV, but the social-engineering barrier is low given draw.io's shareable-URL model.
mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Server-side request forgery in self-hosted draw.io (jgraph/drawio) prior to 30.3.8 lets an unauthenticated remote attacker point the /embed2.js?fetch= endpoint at internal IPv6 Unique Local Address (ULA) resources and read the reflected response, including AWS instance metadata served on the fd00:ec2::/32 range, which can expose IAM credentials and other sensitive internal data. The flaw is a filter bypass rather than a missing check: the private-address guard compared the JDK's fully expanded IPv6 text form against the compressed prefixes 'fc00::' and 'fd00::', so the entire fc00::/7 ULA space slipped through. Exploitation requires a reachable self-hosted draw.io instance and an internal target genuinely addressable over IPv6 ULA - IPv4 private ranges remain blocked, and neither authentication nor the ENABLE_DRAWIO_PROXY=1 flag nor DNS rebinding is needed on the primary /embed2.js path. No public exploit code was identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing); the CVSS 4.0 base score is 7.7 (High), reflecting a network-vector, scope-changing confidentiality impact.
draw.io Desktop 31.4.2 and earlier can disclose the contents of arbitrary local files to script running in the app's own file:// origin, because the Electron main-process read handlers (readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, watchFile) never apply the blessed-path authorization that the write handlers enforce. Exploitation is conditional: it requires attacker-controlled script already executing in that origin - per the advisory, a renderer XSS in the drawio webapp reached when a victim opens a malicious diagram - and the readable set is bounded by a content sniff that admits files beginning with '{' or '[' plus known diagram/media formats, or .mmd/.mermaid extensions; the impact is read-only disclosure, with no write, modification, or denial of service. The advisory publishes a PoC of the readFile IPC primitive; it is not verified as working exploit code, and no confirmed active exploitation is reported. Version 31.4.4 contains the vendor-released patch.
Self-hosted draw.io deployments running the Docker or WAR build prior to 30.2.7 can have a victim's browser session silently bound to the attacker's own cloud-storage identity, because the OAuth callback handler skips verification of the state token against the session cookie whenever IS_GAE is false. An attacker who completes a legitimate authorization for their own account can then induce a victim to open a crafted callback URL, causing subsequent Google Drive, OneDrive, GitHub, GitLab, or Dropbox actions to be performed under the attacker's identity (CVSS 4.2, CVSS:3.1/AV:N/AC:H/PR:N/UI:R, CWE-352); the impact is session integrity loss and misattribution rather than disclosure of the victim's existing cloud files, and no public exploit identified at time of analysis. The hosted SaaS at app.diagrams.net and any Google App Engine build set IS_GAE=true and are unaffected.
Server-side request forgery in self-hosted draw.io deployments prior to 30.2.7 allows unauthenticated remote attackers to make the server fetch attacker-chosen URLs that resolve to private, link-local, or cloud-metadata addresses, returning internal HTTP responses or instance metadata through the image proxy. The flaw only exists when the server is started with ENABLE_DRAWIO_PROXY=1; the SaaS and desktop editions and default installs are unaffected. Successful exploitation depends on a DNS-rebinding timing race (the hostname must resolve to a public address during validation and to an internal address at connection time), which is why the assessed severity is 6.8 with AC:H rather than a high-severity rating; there is no public exploit code identified at time of analysis and the issue is not in CISA KEV. Vendor-released patch: 30.2.7.
Path traversal in the self-hosted draw.io server (jgraph/drawio) before version 30.2.7 allows unauthenticated remote attackers to redirect the ExportProxyServlet's internal proxy request to unintended routes on the configured export backend by supplying dot segments (literal or percent-encoded) in the request path. Because the servlet copies all request headers and the request body to the traversed destination, an attacker can reach administration, debugging, health, or configuration endpoints that the export server happens to expose, and may trigger unintended internal actions, though the practical impact is bounded by how that backend is configured. Exploitation requires a deployment that has the export proxy feature enabled and pointed at an internal export service; there is no public exploit identified at time of analysis, and no EPSS score was supplied, so the vendor's modest CVSS of 3.7 is a reasonable reflection of real-world risk.
Stored cross-site scripting in draw.io (jgraph/drawio) versions prior to 30.2.5 lets an attacker-crafted .drawio diagram execute JavaScript in the draw.io origin once a victim opens or imports the file and selects the affected cells. The payload survives the earlier CVE-2026-46642 remediation because an HTML sibling cell keeps the formatted-label path enabled while an editable=0 plain-text sibling is excluded from the merged selection style yet remains in the iteration set, so graph.cellRenderer.getLabelValue() returns the label unencoded and mxUtils.canConvertHtmlToSvg() then parses it as HTML. Successful exploitation exposes diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim; exploitation requires user interaction (opening or importing an untrusted file) and no public exploit code has been identified at time of analysis, with a vendor CVSS of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Stored cross-site scripting in draw.io prior to version 29.7.12 allows arbitrary JavaScript execution in the editor's origin when a victim opens a crafted .drawio file. The flaw bypasses the existing label sanitizer entirely because it resides in a separate, unsanitized code path - the Text Format panel's feature-detection routine - which assigns raw cell label content directly to a detached DOM element's innerHTML. Exploitation is automatic upon file import since draw.io selects cells programmatically during that process, requiring no additional user interaction beyond opening the file. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Open redirect in draw.io's GitLab OAuth flow allows an attacker to hijack the authorization popup by supplying a crafted `?gitlab=` URL parameter, replacing the legitimate GitLab server with an attacker-controlled host. All draw.io versions prior to 29.7.9 are affected; users who follow a crafted link and click through the 'Authorize in GitLab' dialog expose their credentials and OAuth state tokens to the attacker's phishing endpoint. No public exploit has been identified and CISA has not listed this in KEV, but the social-engineering barrier is low given draw.io's shareable-URL model.
mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.