XSS in Diagrams Drawio
CVE-2026-46642
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer (which works correctly on the rendering path) but in a feature-detection routine in the Text Format panel that reads the raw cell label and assigns it to a detached element's innerHTML without sanitization. Browsers fire onerror for failed image loads even on detached elements, so an <img src=x onerror=...> payload in any cell label triggers script execution as soon as the cell is selected — which import does automatically. This issue has been patched in version 29.7.12.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (12.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 13th percentile — 12.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.002 · change: -0.001
Affected products
- Diagrams Drawio
- Jgraph Drawio — versions < 29.7.12
Weakness classification (CWE)
References
- github.com/jgraph/drawio/releases/tag/v29.7.12 (Release Notes)
- github.com/jgraph/drawio/security/advisories/GHSA-fqhg-287p-c6vf (Exploit, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-46642?
- CVE-2026-46642 is a medium-severity vulnerability in Diagrams Drawio, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-06-10.
- How severe is CVE-2026-46642?
- Medium severity. CVSS v3 base score is 6.1 out of 10.