CVE-2026-42195

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42195", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-25T01:53:21.584Z", "datePublished": "2026-05-08T21:22:40.678Z", "dateUpdated": "2026-05-13T17:47:31.482Z"}, "containers": {"cna": {"title": "Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.4, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x"}, {"name": "https://github.com/jgraph/drawio/issues/493", "tags": ["x_refsource_MISC"], "url": "https://github.com/jgraph/drawio/issues/493"}, {"name": "https://github.com/jgraph/drawio/releases/tag/v29.7.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/jgraph/drawio/releases/tag/v29.7.9"}], "affected": [{"vendor": "jgraph", "product": "drawio", "versions": [{"version": "< 29.7.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T21:22:40.678Z"}, "descriptions": [{"lang": "en", "value": "draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's \"Authorize in GitLab\" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9."}], "source": {"advisory": "GHSA-8x7j-m8px-7p8x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T17:18:43.655474Z", "id": "CVE-2026-42195", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T17:47:31.482Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42195", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T17:18:43.655474Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T17:47:26.304Z"}}], "cna": {"title": "Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host", "source": {"advisory": "GHSA-8x7j-m8px-7p8x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.4, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "jgraph", "product": "drawio", "versions": [{"status": "affected", "version": "< 29.7.9"}]}], "references": [{"url": "https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x", "name": "https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/jgraph/drawio/issues/493", "name": "https://github.com/jgraph/drawio/issues/493", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jgraph/drawio/releases/tag/v29.7.9", "name": "https://github.com/jgraph/drawio/releases/tag/v29.7.9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's \"Authorize in GitLab\" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T21:22:40.678Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42195", "state": "PUBLISHED", "dateUpdated": "2026-05-13T17:47:31.482Z", "dateReserved": "2026-04-25T01:53:21.584Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-08T21:22:40.678Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "drawio", "vendor": "jgraph", "versions": [{"status": "affected", "version": "< 29.7.9"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's \"Authorize in GitLab\" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9."}, {"lang": "es", "value": "draw.io es una aplicaci\u00f3n configurable de diagramaci\u00f3n y pizarra blanca. Antes de la versi\u00f3n 29.7.9, el cliente de draw.io acepta un par\u00e1metro URL ?gitlab= que anula la URL del servidor de GitLab utilizada durante el inicio de sesi\u00f3n OAuth. Un enlace manipulado hace que el clic del usuario en el di\u00e1logo \u2019Autorizar en GitLab\u2019 de draw.io abra una ventana emergente en el host controlado por el atacante en lugar de gitlab.com. Esto puede conducir a phishing de credenciales y a la exfiltraci\u00f3n de tokens de estado de sesi\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 29.7.9."}], "id": "CVE-2026-42195", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.4, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42195", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-13T17:18:43.655474Z", "version": "2.0.3"}}]}, "published": "2026-05-08T22:16:31.410", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/jgraph/drawio/issues/493"}, {"source": "security-advisories@github.com", "url": "https://github.com/jgraph/drawio/releases/tag/v29.7.9"}, {"source": "security-advisories@github.com", "url": "https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,29.7.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "drawio", "source": "cna", "vendor": "jgraph"}, "product": "drawio", "vendor": "jgraph"}], "created": "2026-05-08T22:30:18.333492+00:00", "updated": "2026-05-08T23:45:20.230188+00:00", "vendors": ["jgraph", "jgraph$PRODUCT$drawio"]}