# jgraph drawio.

Every CVE that names jgraph drawio among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [draw.io: Prototype pollution in GraphML (mxGraphMlCodec)](https://agentprime.io/advisories/CVE-2026-115762.md)
  `CVE-2026-115762` · CVE record: jgraph drawio · CVSS 6.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Prototype pollution
- [draw.io: Incomplete SSRF blocklist in \`ProxyServlet\` / \`Utils.sanitizeUrl\`: RFC 6598 CGNAT range \`100.64.0.0/10\` is not blocked -> server-side request to internal CGNAT hosts](https://agentprime.io/advisories/CVE-2026-97373.md)
  `CVE-2026-97373` · CVE record: jgraph drawio · CVSS 5.8 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Server-side request forgery (SSRF)
- [draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js](https://agentprime.io/advisories/CVE-2026-76898.md)
  `CVE-2026-76898` · CVE record: jgraph drawio · CVSS 7.7 High · Not analysed yet · Published 21 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection](https://agentprime.io/advisories/CVE-2026-63373.md)
  `CVE-2026-63373` · CVE record: jgraph drawio · CVSS 4.2 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist](https://agentprime.io/advisories/CVE-2026-63334.md)
  `CVE-2026-63334` · CVE record: jgraph drawio · CVSS 6.8 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Race condition, Server-side request forgery (SSRF)
- [draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints](https://agentprime.io/advisories/CVE-2026-63416.md)
  `CVE-2026-63416` · CVE record: jgraph drawio · CVSS 3.7 Low · Not analysed yet · Published 21 Sept 2026 · Tags: Path traversal
- [draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642](https://agentprime.io/advisories/CVE-2026-58504.md)
  `CVE-2026-58504` · CVE record: jgraph drawio · CVSS 6.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [draw.io: XSS via crafted cell label when opening a .drawio file](https://agentprime.io/advisories/CVE-2026-46642.md)
  `CVE-2026-46642` · CVE record: jgraph drawio · CVSS 6.1 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host](https://agentprime.io/advisories/CVE-2026-42195.md)
  `CVE-2026-42195` · CVE record: jgraph drawio · CVSS 3.4 Low · Not analysed yet · Published 8 May 2026 · Tags: Information disclosure, Open redirect
- [OS Command Injection in jgraph/drawio](https://agentprime.io/advisories/CVE-2023-3975.md)
  `CVE-2023-3975` · CVE record: jgraph jgraph/drawio · CVSS 8.3 High · Not analysed yet · Published 27 Jul 2023 · Tags: Command injection
- [OS Command Injection in jgraph/drawio](https://agentprime.io/advisories/CVE-2023-3974.md)
  `CVE-2023-3974` · CVE record: jgraph jgraph/drawio · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2023 · Tags: Command injection
- [Cross-site Scripting (XSS) - Reflected in jgraph/drawio](https://agentprime.io/advisories/CVE-2023-3973.md)
  `CVE-2023-3973` · CVE record: jgraph jgraph/drawio · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2023 · Tags: Cross-site scripting (XSS)
- [Denial of Service in jgraph/drawio](https://agentprime.io/advisories/CVE-2023-3398.md)
  `CVE-2023-3398` · CVE record: jgraph jgraph/drawio · CVSS 5.3 Medium · Not analysed yet · Published 26 Jun 2023 · Tags: Denial of service
- [Cross-site Scripting (XSS) - Stored in jgraph/drawio](https://agentprime.io/advisories/CVE-2023-3026.md)
  `CVE-2023-3026` · CVE record: jgraph jgraph/drawio · CVSS 6.5 Medium · Not analysed yet · Published 1 Jun 2023 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting (XSS) - DOM in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-3873.md)
  `CVE-2022-3873` · CVE record: jgraph jgraph/drawio · CVSS 6.5 Medium · Not analysed yet · Published 7 Nov 2022 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting (XSS) - Stored in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-3223.md)
  `CVE-2022-3223` · CVE record: jgraph jgraph/drawio · CVSS 4.3 Medium · Not analysed yet · Published 16 Sept 2022 · Tags: Cross-site scripting (XSS)
- [OS Command Injection in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-3133.md)
  `CVE-2022-3133` · CVE record: jgraph jgraph/drawio · CVSS 7.0 High · Not analysed yet · Published 9 Sept 2022 · Tags: Command injection
- [Cross-site Scripting (XSS) - Generic in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-3138.md)
  `CVE-2022-3138` · CVE record: jgraph jgraph/drawio · CVSS 4.3 Medium · Not analysed yet · Published 8 Sept 2022 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting (XSS) - Generic in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-3148.md)
  `CVE-2022-3148` · CVE record: jgraph jgraph/drawio · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2022 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting (XSS) - Stored in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-3127.md)
  `CVE-2022-3127` · CVE record: jgraph jgraph/drawio · CVSS 5.5 Medium · Not analysed yet · Published 5 Sept 2022 · Tags: Cross-site scripting (XSS)
- [Improper Access Control in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-3065.md)
  `CVE-2022-3065` · CVE record: jgraph jgraph/drawio · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2022 · Tags: Broken access control
- [Cross-site Scripting (XSS) - Stored in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-2015.md)
  `CVE-2022-2015` · CVE record: jgraph jgraph/drawio · CVSS 6.1 Medium · Not analysed yet · Published 8 Jun 2022 · Tags: Cross-site scripting (XSS)
- [Code Injection in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-2014.md)
  `CVE-2022-2014` · CVE record: jgraph jgraph/drawio · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jun 2022 · Tags: Code injection
- [Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-1815.md)
  `CVE-2022-1815` · CVE record: jgraph jgraph/drawio · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2022 · Tags: Information disclosure
- [Server-Side Request Forgery (SSRF) in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-1784.md)
  `CVE-2022-1784` · CVE record: jgraph jgraph/drawio · CVSS 7.5 High · Not analysed yet · Published 20 May 2022 · Tags: Server-side request forgery (SSRF)
- [Cross-site Scripting (XSS) - Stored in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-1730.md)
  `CVE-2022-1730` · CVE record: jgraph jgraph/drawio · CVSS 6.3 Medium · Not analysed yet · Published 19 May 2022 · Tags: Cross-site scripting (XSS)
- [Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-1774.md)
  `CVE-2022-1774` · CVE record: jgraph jgraph/drawio · CVSS 8.2 High · Not analysed yet · Published 18 May 2022 · Tags: Information disclosure
- [Server-Side Request Forgery (SSRF) in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-1767.md)
  `CVE-2022-1767` · CVE record: jgraph jgraph/drawio · CVSS 7.5 High · Not analysed yet · Published 18 May 2022 · Tags: Server-side request forgery (SSRF)
- [Improper Input Validation in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-1727.md)
  `CVE-2022-1727` · CVE record: jgraph jgraph/drawio · CVSS 8.3 High · Not analysed yet · Published 18 May 2022 · Tags: CWE-20
- [Server-Side Request Forgery (SSRF) in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-1711.md)
  `CVE-2022-1711` · CVE record: jgraph jgraph/drawio · CVSS 7.5 High · Not analysed yet · Published 17 May 2022 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery (SSRF) in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-1723.md)
  `CVE-2022-1723` · CVE record: jgraph jgraph/drawio · CVSS 7.5 High · Not analysed yet · Published 17 May 2022 · Tags: Server-side request forgery (SSRF)
- [SSRF on /proxy in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-1713.md)
  `CVE-2022-1713` · CVE record: jgraph jgraph/drawio · CVSS 7.5 High · Not analysed yet · Published 16 May 2022 · Tags: Server-side request forgery (SSRF)
- [Path Traversal in WellKnownServlet in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-1721.md)
  `CVE-2022-1721` · CVE record: jgraph jgraph/drawio · CVSS 7.5 High · Not analysed yet · Published 16 May 2022 · Tags: Path traversal
- [SSRF in editor's proxy via IPv6 link-local address in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-1722.md)
  `CVE-2022-1722` · CVE record: jgraph jgraph/drawio · CVSS 7.5 High · Not analysed yet · Published 16 May 2022 · Tags: Server-side request forgery (SSRF)
- [Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio](https://agentprime.io/advisories/CVE-2022-1575.md)
  `CVE-2022-1575` · CVE record: jgraph jgraph/drawio · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2022 · Tags: Code injection

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=jgraph-drawio>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/jgraph-drawio/>. Everything for agents: <https://agentprime.io/llms.txt>.