Jgraph Drawio vulnerabilities

• jgraph drawio draw.io: Prototype pollution in GraphML (mxGraphMlCodec) CVE-2026-115762 6.1 MediumNovember 4, 2026
• jgraph drawio draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts CVE-2026-97373 5.8 MediumNovember 4, 2026
• jgraph drawio-desktop draw.io Desktop allows Windows executable search-path hijacking CVE-2026-119333 7.8 HighOctober 30, 2026
• jgraph drawio-desktop draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate) CVE-2026-114606 5.6 MediumOctober 22, 2026
• jgraph drawio draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js CVE-2026-76898 7.7 HighSeptember 21, 2026
• jgraph drawio draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection CVE-2026-63373 4.2 MediumSeptember 21, 2026
• jgraph drawio draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist CVE-2026-63334 6.8 MediumSeptember 21, 2026
• jgraph drawio draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints CVE-2026-63416 3.7 LowSeptember 21, 2026
• jgraph drawio draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642 CVE-2026-58504 6.1 MediumSeptember 21, 2026
• diagrams drawio draw.io: XSS via crafted cell label when opening a .drawio file CVE-2026-46642 6.1 MediumJune 10, 2026
• jgraph drawio Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host CVE-2026-42195 3.4 LowMay 8, 2026
• diagrams drawio, jgraph jgraph/drawio +1 more OS Command Injection in jgraph/drawio CVE-2023-3975 8.3 HighJuly 27, 2023
• diagrams drawio, jgraph jgraph/drawio +1 more OS Command Injection in jgraph/drawio CVE-2023-3974 9.6 CriticalJuly 27, 2023
• diagrams drawio, jgraph jgraph/drawio +1 more Cross-site Scripting (XSS) - Reflected in jgraph/drawio CVE-2023-3973 9.6 CriticalJuly 27, 2023
• diagrams drawio, jgraph jgraph/drawio +1 more Denial of Service in jgraph/drawio CVE-2023-3398 5.3 MediumJune 26, 2023
• diagrams drawio, jgraph jgraph/drawio +1 more Cross-site Scripting (XSS) - Stored in jgraph/drawio CVE-2023-3026 6.5 MediumJune 1, 2023
• diagrams drawio, jgraph jgraph/drawio +1 more Cross-site Scripting (XSS) - DOM in jgraph/drawio CVE-2022-3873 6.5 MediumNovember 7, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Cross-site Scripting (XSS) - Stored in jgraph/drawio CVE-2022-3223 4.3 MediumSeptember 16, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more OS Command Injection in jgraph/drawio CVE-2022-3133 7.0 HighSeptember 9, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Cross-site Scripting (XSS) - Generic in jgraph/drawio CVE-2022-3138 4.3 MediumSeptember 8, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Cross-site Scripting (XSS) - Generic in jgraph/drawio CVE-2022-3148 5.3 MediumSeptember 8, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Cross-site Scripting (XSS) - Stored in jgraph/drawio CVE-2022-3127 5.5 MediumSeptember 5, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Improper Access Control in jgraph/drawio CVE-2022-3065 5.3 MediumSeptember 2, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Cross-site Scripting (XSS) - Stored in jgraph/drawio CVE-2022-2015 6.1 MediumJune 8, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Code Injection in jgraph/drawio CVE-2022-2014 9.6 CriticalJune 8, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio CVE-2022-1815 5.3 MediumMay 25, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Server-Side Request Forgery (SSRF) in jgraph/drawio CVE-2022-1784 7.5 HighMay 20, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Cross-site Scripting (XSS) - Stored in jgraph/drawio CVE-2022-1730 6.3 MediumMay 19, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio CVE-2022-1774 8.2 HighMay 18, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Server-Side Request Forgery (SSRF) in jgraph/drawio CVE-2022-1767 7.5 HighMay 18, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Improper Input Validation in jgraph/drawio CVE-2022-1727 8.3 HighMay 18, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Server-Side Request Forgery (SSRF) in jgraph/drawio CVE-2022-1711 7.5 HighMay 17, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Server-Side Request Forgery (SSRF) in jgraph/drawio CVE-2022-1723 7.5 HighMay 17, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more SSRF on /proxy in jgraph/drawio CVE-2022-1713 7.5 HighMay 16, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Path Traversal in WellKnownServlet in jgraph/drawio CVE-2022-1721 7.5 HighMay 16, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more SSRF in editor's proxy via IPv6 link-local address in jgraph/drawio CVE-2022-1722 7.5 HighMay 16, 2022
• diagrams drawio, jgraph jgraph/drawio +1 more Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio CVE-2022-1575 9.6 CriticalMay 5, 2022