What’s Vulnerable › Products

jgraph/drawio vulnerabilities

33 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your jgraph/drawio version is affected

Latest jgraph/drawio vulnerabilities

• CVE-2026-76898 — draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js (CVSS 7.7)
• CVE-2026-63416 — draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints (CVSS 3.7)
• CVE-2026-63373 — draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection (CVSS 4.2)
• CVE-2026-63334 — draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist (CVSS 6.8)
• CVE-2026-58504 — draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642 (CVSS 6.1)
• CVE-2026-46642 — draw.io: XSS via crafted cell label when opening a .drawio file (CVSS 6.1)
• CVE-2026-42195 — Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host (CVSS 3.4)
• CVE-2023-3975 — OS Command Injection in jgraph/drawio (CVSS 9.8)
• CVE-2023-3974 — OS Command Injection in jgraph/drawio (CVSS 9.8)
• CVE-2023-3973 — Cross-site Scripting (XSS) - Reflected in jgraph/drawio (CVSS 6.1)
• CVE-2023-3398 — Denial of Service in jgraph/drawio (CVSS 7.5)
• CVE-2023-3026 — Cross-site Scripting (XSS) - Stored in jgraph/drawio (CVSS 6.1)
• CVE-2022-3873 — Cross-site Scripting (XSS) - DOM in jgraph/drawio (CVSS 6.1)
• CVE-2022-3223 — Cross-site Scripting (XSS) - Stored in jgraph/drawio (CVSS 6.1)
• CVE-2022-3133 — OS Command Injection in jgraph/drawio (CVSS 7.8)
• CVE-2022-3148 — Cross-site Scripting (XSS) - Generic in jgraph/drawio (CVSS 6.1)
• CVE-2022-3138 — Cross-site Scripting (XSS) - Generic in jgraph/drawio (CVSS 6.1)
• CVE-2022-3127 — Cross-site Scripting (XSS) - Stored in jgraph/drawio (CVSS 5.4)
• CVE-2022-3065 — Improper Access Control in jgraph/drawio (CVSS 7.5)
• CVE-2022-2015 — Cross-site Scripting (XSS) - Stored in jgraph/drawio (CVSS 5.4)
• CVE-2022-2014 — Code Injection in jgraph/drawio (CVSS 5.4)
• CVE-2022-1815 — Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio (CVSS 7.5)
• CVE-2022-1784 — Server-Side Request Forgery (SSRF) in jgraph/drawio (CVSS 7.5)
• CVE-2022-1730 — Cross-site Scripting (XSS) - Stored in jgraph/drawio (CVSS 4.6)
• CVE-2022-1774 — Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio (CVSS 6.1)