jgraph vulnerabilities

CVEs per yearBy the year they were published

1. 202221
2. 20235
3. 202611

Newest CVEs

• CVE-2026-115762

  draw.io: Prototype pollution in GraphML (mxGraphMlCodec)

  jgraph · drawio

  Medium6.1
• CVE-2026-97373

  draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts

  jgraph · drawio

  Medium5.8
• CVE-2026-119333

  draw.io Desktop allows Windows executable search-path hijacking

  jgraph · drawio-desktop

  High7.8
• CVE-2026-114606

  draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)

  jgraph · drawio-desktop

  Medium5.6
• CVE-2026-76898

  draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js

  jgraph · drawio

  High7.7
• CVE-2026-63373

  draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection

  jgraph · drawio

  Medium4.2
• CVE-2026-63334

  draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist

  jgraph · drawio

  Medium6.8
• CVE-2026-63416

  draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints

  jgraph · drawio

  Low3.7
• CVE-2026-58504

  draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642

  jgraph · drawio

  Medium6.1
• CVE-2026-46642

  draw.io: XSS via crafted cell label when opening a .drawio file

  jgraph · drawio

  Medium6.1