Jgraph / Drawio
10 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-76898 | draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js | HIGH | 7.7 | Sep 21, 2026 |
| CVE-2026-63373 | draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection | MEDIUM | 4.2 | Sep 21, 2026 |
| CVE-2026-63334 | draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist | MEDIUM | 6.8 | Sep 21, 2026 |
| CVE-2026-63416 | draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints | LOW | 3.7 | Sep 21, 2026 |
| CVE-2026-58504 | draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642 | MEDIUM | 6.1 | Sep 21, 2026 |
| CVE-2026-46642 | draw.io: XSS via crafted cell label when opening a .drawio file | MEDIUM | 6.1 | Jun 10, 2026 |
| CVE-2026-42195 | Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host | LOW | 3.4 | May 8, 2026 |
| CVE-2023-3975 | OS Command Injection in jgraph/drawio | CRITICAL | 9.8 | Jul 27, 2023 |
| CVE-2023-3974 | OS Command Injection in jgraph/drawio | CRITICAL | 9.8 | Jul 27, 2023 |
| CVE-2023-3973 | Cross-site Scripting (XSS) - Reflected in jgraph/drawio | MEDIUM | 6.1 | Jul 27, 2023 |
Showing 1 to 10 of 10 CVEs