What’s Vulnerable › Vulnerabilities

CVE-2026-42195: Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host

• Severity: low (CVSS 3.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-08 · updated 2026-10-26
• Weakness: CWE-200

Description

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.

Affected products

• jgraph/drawio: before 29.7.9

References

• https://github.com/jgraph/drawio/issues/493
• https://github.com/jgraph/drawio/releases/tag/v29.7.9
• https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x

Get alerted when CVE-2026-42195 or the next vulnerability affects your stack