jgraph drawio vulnerabilities

Newest CVEs

• CVE-2026-115762

  draw.io: Prototype pollution in GraphML (mxGraphMlCodec)

  jgraph · drawio

  Medium6.1
• CVE-2026-97373

  draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts

  jgraph · drawio

  Medium5.8
• CVE-2026-76898

  draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js

  jgraph · drawio

  High7.7
• CVE-2026-63373

  draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection

  jgraph · drawio

  Medium4.2
• CVE-2026-63334

  draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist

  jgraph · drawio

  Medium6.8
• CVE-2026-63416

  draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints

  jgraph · drawio

  Low3.7
• CVE-2026-58504

  draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642

  jgraph · drawio

  Medium6.1
• CVE-2026-46642

  draw.io: XSS via crafted cell label when opening a .drawio file

  jgraph · drawio

  Medium6.1
• CVE-2026-42195

  Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host

  jgraph · drawio

  Low3.4