Log in Start free

jgraph

Products

ProductCVEsExploitedLatest
jgraph/drawio26–Jul 27, 2023
drawio9–Nov 4, 2026
drawio-desktop2–Oct 30, 2026

Exploited and recent CVEs

  • CVE-2026-115762 Medium 6.1 draw.io: Prototype pollution in GraphML (mxGraphMlCodec) 0.2%
  • CVE-2026-97373 Medium 5.8 draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts 0.2%
  • CVE-2026-119333 High 7.8 draw.io Desktop allows Windows executable search-path hijacking 0.1%
  • CVE-2026-114606 Medium 5.6 draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate) 0.4%
  • CVE-2026-76898 High 7.7 draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js 0.4%
  • CVE-2026-63373 Medium 4.2 draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection 0.2%
  • CVE-2026-63334 Medium 6.8 draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist 0.3%
  • CVE-2026-63416 Low 3.7 draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints 0.3%
  • CVE-2026-58504 Medium 6.1 draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642 0.2%
  • CVE-2026-46642 Medium 6.1 draw.io: XSS via crafted cell label when opening a .drawio file 0.2%
  • CVE-2026-42195 Low 3.4 Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host 0.2%
  • CVE-2023-3975 High 8.3 OS Command Injection in jgraph/drawio 2.3%
  • CVE-2023-3974 Critical 9.6 OS Command Injection in jgraph/drawio 1.2%
  • CVE-2023-3973 Critical 9.6 Cross-site Scripting (XSS) - Reflected in jgraph/drawio 0.4%
  • CVE-2023-3398 Medium 5.3 Denial of Service in jgraph/drawio 1.0%
  • CVE-2023-3026 Medium 6.5 Cross-site Scripting (XSS) - Stored in jgraph/drawio 0.5%
  • CVE-2022-3873 Medium 6.5 Cross-site Scripting (XSS) - DOM in jgraph/drawio 0.9%
  • CVE-2022-3223 Medium 4.3 Cross-site Scripting (XSS) - Stored in jgraph/drawio 0.8%
  • CVE-2022-3133 High 7.0 OS Command Injection in jgraph/drawio 1.1%
  • CVE-2022-3138 Medium 4.3 Cross-site Scripting (XSS) - Generic in jgraph/drawio 0.7%
  • CVE-2022-3148 Medium 5.3 Cross-site Scripting (XSS) - Generic in jgraph/drawio 0.7%
  • CVE-2022-3127 Medium 5.5 Cross-site Scripting (XSS) - Stored in jgraph/drawio 0.6%
  • CVE-2022-3065 Medium 5.3 Improper Access Control in jgraph/drawio 1.3%
  • CVE-2022-2015 Medium 6.1 Cross-site Scripting (XSS) - Stored in jgraph/drawio 0.6%
  • CVE-2022-2014 Critical 9.6 Code Injection in jgraph/drawio 0.7%
  • CVE-2022-1815 Medium 5.3 Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio 5.4%
  • CVE-2022-1784 High 7.5 Server-Side Request Forgery (SSRF) in jgraph/drawio 1.8%
  • CVE-2022-1730 Medium 6.3 Cross-site Scripting (XSS) - Stored in jgraph/drawio 0.6%
  • CVE-2022-1774 High 8.2 Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio 1.2%
  • CVE-2022-1767 High 7.5 Server-Side Request Forgery (SSRF) in jgraph/drawio 1.8%