CVE-2026-46642

draw.io: XSS via crafted cell label when opening a .drawio file

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer (which works correctly on the rendering path) but in a feature-detection routine in the Text Format panel that reads the raw cell label and assigns it to a detached element's innerHTML without sanitization. Browsers fire onerror for failed image loads even on detached elements, so an <img src=x onerror=...> payload in any cell label triggers script execution as soon as the cell is selected — which import does automatically. This issue has been patched in version 29.7.12.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Diagrams Jgraph

Products

Drawio Drawio

CVE-2022-3873

Cross-site Scripting (XSS) - DOM in jgraph/drawio

Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2023-3026

Cross-site Scripting (XSS) - Stored in jgraph/drawio

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2023-3398

Denial of Service in jgraph/drawio

Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2023-3975

OS Command Injection in jgraph/drawio

OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.

CVSS 3.1 · 9.8 Critical EPSS 2.3% KEV · Not listed

Vendors

Diagrams Jgraph

Products

Drawio Drawio

CVE-2023-3974

OS Command Injection in jgraph/drawio

OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed

Vendors

Diagrams Jgraph

Products

Drawio Drawio

CVE-2023-3973

Cross-site Scripting (XSS) - Reflected in jgraph/drawio

Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Diagrams Jgraph

Products

Drawio Drawio

CVE-2022-3223

Cross-site Scripting (XSS) - Stored in jgraph/drawio

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-3148

Cross-site Scripting (XSS) - Generic in jgraph/drawio

Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-3138

Cross-site Scripting (XSS) - Generic in jgraph/drawio

Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-3133

OS Command Injection in jgraph/drawio

OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-3127

Cross-site Scripting (XSS) - Stored in jgraph/drawio

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-3065

Improper Access Control in jgraph/drawio

Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-2015

Cross-site Scripting (XSS) - Stored in jgraph/drawio

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-2014

Code Injection in jgraph/drawio

Code Injection in GitHub repository jgraph/drawio prior to 19.0.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-1815

Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.

CVSS 3.1 · 7.5 High EPSS 5.4% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-1784

Server-Side Request Forgery (SSRF) in jgraph/drawio

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-1774

Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.

CVSS 3.1 · 6.1 Medium EPSS 1.2% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-1767

Server-Side Request Forgery (SSRF) in jgraph/drawio

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-1730

Cross-site Scripting (XSS) - Stored in jgraph/drawio

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Diagrams

Products

Drawio