Drawio
by Jgraph
Source repositories
CVEs (33)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-76898 | Hig | 0.43 | — | 0.00 | Sep 21, 2026 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded… | ||
| CVE-2026-63334 | Med | 0.37 | 6.8 | 0.00 | Sep 21, 2026 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in… | ||
| CVE-2026-58504 | Med | 0.33 | 6.1 | 0.00 | Sep 21, 2026 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.addFont() in… | ||
| CVE-2026-46642 | Med | 0.33 | 6.1 | 0.00 | Jun 10, 2026 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer (which works correctly on the… | ||
| CVE-2026-63373 | Med | 0.20 | 4.2 | 0.00 | Sep 21, 2026 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever IS_GAE is false, which affects self-hosted Docker and… | ||
| CVE-2026-63416 | Low | 0.17 | 3.7 | 0.00 | Sep 21, 2026 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot segments or… | ||
| CVE-2026-42195 | Low | 0.15 | 3.4 | 0.00 | May 8, 2026 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in… | ||
| CVE-2022-1713 | Hig | 0.01 | 7.5 | 0.10 | May 16, 2022 | SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information. | ||
| CVE-2023-3975 | Cri | 0.00 | 9.8 | 0.02 | Jul 27, 2023 | OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0. | ||
| CVE-2023-3974 | Cri | 0.00 | 9.8 | 0.01 | Jul 27, 2023 | OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0. | ||
| CVE-2023-3973 | Med | 0.00 | 6.1 | 0.00 | Jul 27, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3. | ||
| CVE-2023-3398 | Hig | 0.00 | 7.5 | 0.01 | Jun 26, 2023 | Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3. | ||
| CVE-2023-3026 | Med | 0.00 | 6.1 | 0.01 | Jun 1, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8. | ||
| CVE-2022-3873 | Med | 0.00 | 6.1 | 0.01 | Nov 7, 2022 | Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2. | ||
| CVE-2022-3223 | Med | 0.00 | 6.1 | 0.01 | Sep 16, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1. | ||
| CVE-2022-3133 | Hig | 0.00 | 7.8 | 0.01 | Sep 9, 2022 | OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0. | ||
| CVE-2022-3148 | Med | 0.00 | 6.1 | 0.01 | Sep 8, 2022 | Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0. | ||
| CVE-2022-3138 | Med | 0.00 | 6.1 | 0.01 | Sep 8, 2022 | Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0. | ||
| CVE-2022-3127 | Med | 0.00 | 5.4 | 0.01 | Sep 5, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8. | ||
| CVE-2022-3065 | Hig | 0.00 | 7.5 | 0.01 | Sep 2, 2022 | Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8. |
- risk 0.43cvss —epss 0.00
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded…
- risk 0.37cvss 6.8epss 0.00
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in…
- risk 0.33cvss 6.1epss 0.00
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.addFont() in…
- risk 0.33cvss 6.1epss 0.00
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer (which works correctly on the…
- risk 0.20cvss 4.2epss 0.00
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever IS_GAE is false, which affects self-hosted Docker and…
- risk 0.17cvss 3.7epss 0.00
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot segments or…
- risk 0.15cvss 3.4epss 0.00
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in…
- risk 0.01cvss 7.5epss 0.10
SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information.
- risk 0.00cvss 9.8epss 0.02
OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.
- risk 0.00cvss 9.8epss 0.01
OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.
- risk 0.00cvss 6.1epss 0.00
Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.
- risk 0.00cvss 7.5epss 0.01
Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.
- risk 0.00cvss 6.1epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.
- risk 0.00cvss 6.1epss 0.01
Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.
- risk 0.00cvss 6.1epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1.
- risk 0.00cvss 7.8epss 0.01
OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.
- risk 0.00cvss 6.1epss 0.01
Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.
- risk 0.00cvss 6.1epss 0.01
Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.
- risk 0.00cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.
- risk 0.00cvss 7.5epss 0.01
Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.
Page 1 of 2