Advisories · Technology

jgraph drawio.

Every CVE that names jgraph drawio among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-115762 CVE record

CVSS 6.1 Medium

draw.io: Prototype pollution in GraphML (mxGraphMlCodec)
- jgraph drawio
- Prototype pollution
Not analysed yet 4 Nov 2026
CVE-2026-97373 CVE record

CVSS 5.8 Medium

draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts
- jgraph drawio
- Server-side request forgery (SSRF)
Not analysed yet 4 Nov 2026
CVE-2026-76898 CVE record

CVSS 7.7 High

draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js
- jgraph drawio
- Server-side request forgery (SSRF)
Not analysed yet 21 Sept 2026
CVE-2026-63373 CVE record

CVSS 4.2 Medium

draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection
- jgraph drawio
- Cross-site request forgery (CSRF)
Not analysed yet 21 Sept 2026
CVE-2026-63334 CVE record

CVSS 6.8 Medium

draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist
- jgraph drawio
- Race condition
- Server-side request forgery (SSRF)
Not analysed yet 21 Sept 2026
CVE-2026-63416 CVE record

CVSS 3.7 Low

draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints
- jgraph drawio
- Path traversal
Not analysed yet 21 Sept 2026
CVE-2026-58504 CVE record

CVSS 6.1 Medium

draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642
- jgraph drawio
- Cross-site scripting (XSS)
- CWE-116
Not analysed yet 21 Sept 2026
CVE-2026-46642 CVE record

CVSS 6.1 Medium

draw.io: XSS via crafted cell label when opening a .drawio file
- jgraph drawio
- Cross-site scripting (XSS)
Not analysed yet 10 Jun 2026
CVE-2026-42195 CVE record

CVSS 3.4 Low

Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host
- jgraph drawio
- Information disclosure
- Open redirect
Not analysed yet 8 May 2026
CVE-2023-3975 CVE record

CVSS 8.3 High

OS Command Injection in jgraph/drawio
- jgraph/drawio
- Command injection
Not analysed yet 27 Jul 2023
CVE-2023-3974 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

OS Command Injection in jgraph/drawio
- jgraph/drawio
- Command injection
Not analysed yet 27 Jul 2023
CVE-2023-3973 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Cross-site Scripting (XSS) - Reflected in jgraph/drawio
- jgraph/drawio
- Cross-site scripting (XSS)
Not analysed yet 27 Jul 2023
CVE-2023-3398 CVE record

CVSS 5.3 Medium

Denial of Service in jgraph/drawio
- jgraph/drawio
- Denial of service
Not analysed yet 26 Jun 2023
CVE-2023-3026 CVE record

CVSS 6.5 Medium

Cross-site Scripting (XSS) - Stored in jgraph/drawio
- jgraph/drawio
- Cross-site scripting (XSS)
Not analysed yet 1 Jun 2023
CVE-2022-3873 CVE record

CVSS 6.5 Medium

Cross-site Scripting (XSS) - DOM in jgraph/drawio
- jgraph/drawio
- Cross-site scripting (XSS)
Not analysed yet 7 Nov 2022
CVE-2022-3223 CVE record

CVSS 4.3 Medium

Cross-site Scripting (XSS) - Stored in jgraph/drawio
- jgraph/drawio
- Cross-site scripting (XSS)
Not analysed yet 16 Sept 2022
CVE-2022-3133 CVE record

CVSS 7.0 High

OS Command Injection in jgraph/drawio
- jgraph/drawio
- Command injection
Not analysed yet 9 Sept 2022
CVE-2022-3138 CVE record

CVSS 4.3 Medium

Cross-site Scripting (XSS) - Generic in jgraph/drawio
- jgraph/drawio
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2022
CVE-2022-3148 CVE record

CVSS 5.3 Medium

Cross-site Scripting (XSS) - Generic in jgraph/drawio
- jgraph/drawio
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2022
CVE-2022-3127 CVE record

CVSS 5.5 Medium

Cross-site Scripting (XSS) - Stored in jgraph/drawio
- jgraph/drawio
- Cross-site scripting (XSS)
Not analysed yet 5 Sept 2022
CVE-2022-3065 CVE record

CVSS 5.3 Medium

Improper Access Control in jgraph/drawio
- jgraph/drawio
- Broken access control
Not analysed yet 2 Sept 2022
CVE-2022-2015 CVE record

CVSS 6.1 Medium

Cross-site Scripting (XSS) - Stored in jgraph/drawio
- jgraph/drawio
- Cross-site scripting (XSS)
Not analysed yet 8 Jun 2022
CVE-2022-2014 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Code Injection in jgraph/drawio
- jgraph/drawio
- Code injection
Not analysed yet 8 Jun 2022
CVE-2022-1815 CVE record

CVSS 5.3 Medium

Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio
- jgraph/drawio
- Information disclosure
Not analysed yet 25 May 2022
CVE-2022-1784 CVE record

CVSS 7.5 High

Server-Side Request Forgery (SSRF) in jgraph/drawio
- jgraph/drawio
- Server-side request forgery (SSRF)
Not analysed yet 20 May 2022
CVE-2022-1730 CVE record

CVSS 6.3 Medium

Cross-site Scripting (XSS) - Stored in jgraph/drawio
- jgraph/drawio
- Cross-site scripting (XSS)
Not analysed yet 19 May 2022
CVE-2022-1774 CVE record

CVSS 8.2 High

Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio
- jgraph/drawio
- Information disclosure
Not analysed yet 18 May 2022
CVE-2022-1767 CVE record

CVSS 7.5 High

Server-Side Request Forgery (SSRF) in jgraph/drawio
- jgraph/drawio
- Server-side request forgery (SSRF)
Not analysed yet 18 May 2022
CVE-2022-1727 CVE record

CVSS 8.3 High

Improper Input Validation in jgraph/drawio
- jgraph/drawio
- CWE-20
Not analysed yet 18 May 2022
CVE-2022-1711 CVE record

CVSS 7.5 High

Server-Side Request Forgery (SSRF) in jgraph/drawio
- jgraph/drawio
- Server-side request forgery (SSRF)
Not analysed yet 17 May 2022
CVE-2022-1723 CVE record

CVSS 7.5 High

Server-Side Request Forgery (SSRF) in jgraph/drawio
- jgraph/drawio
- Server-side request forgery (SSRF)
Not analysed yet 17 May 2022
CVE-2022-1713 CVE record

CVSS 7.5 High

SSRF on /proxy in jgraph/drawio
- jgraph/drawio
- Server-side request forgery (SSRF)
Not analysed yet 16 May 2022
CVE-2022-1721 CVE record

CVSS 7.5 High

Path Traversal in WellKnownServlet in jgraph/drawio
- jgraph/drawio
- Path traversal
Not analysed yet 16 May 2022
CVE-2022-1722 CVE record

CVSS 7.5 High

SSRF in editor's proxy via IPv6 link-local address in jgraph/drawio
- jgraph/drawio
- Server-side request forgery (SSRF)
Not analysed yet 16 May 2022
CVE-2022-1575 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio
- jgraph/drawio
- Code injection
Not analysed yet 5 May 2022