CVE-2026-46642 | Medium | 6.1 | 2026-06-10 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the e… |
CVE-2026-42195 | Low | 3.4 | 2026-05-08 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that override… |
CVE-2023-3975 | Critical | 9.8 | 2023-07-27 | OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0. |
CVE-2023-3974 | Critical | 9.8 | 2023-07-27 | OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0. |
CVE-2023-3973 | Medium | 6.1 | 2023-07-27 | Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3. |
CVE-2023-3398 | High | 7.5 | 2023-06-26 | Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3. |
CVE-2023-3026 | Medium | 6.1 | 2023-06-01 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8. |
CVE-2022-3873 | Medium | 6.1 | 2022-11-07 | Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2. |
CVE-2022-40440 | Medium | 6.1 | 2022-10-12 | mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function. |
CVE-2022-3223 | Medium | 6.1 | 2022-09-16 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1. |
CVE-2022-3133 | High | 7.8 | 2022-09-09 | OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0. |
CVE-2022-3148 | Medium | 6.1 | 2022-09-08 | Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0. |
CVE-2022-3138 | Medium | 6.1 | 2022-09-08 | Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0. |
CVE-2022-3127 | Medium | 5.4 | 2022-09-05 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8. |
CVE-2022-3065 | High | 7.5 | 2022-09-02 | Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8. |
CVE-2022-2015 | Medium | 5.4 | 2022-06-09 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2. |
CVE-2022-2014 | Medium | 5.4 | 2022-06-09 | Code Injection in GitHub repository jgraph/drawio prior to 19.0.2. |
CVE-2022-1815 | High | 7.5 | 2022-05-25 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2. |
CVE-2022-1784 | High | 7.5 | 2022-05-20 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8. |
CVE-2022-1730 | Medium | 4.6 | 2022-05-19 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4. |
CVE-2022-1774 | Medium | 6.1 | 2022-05-18 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7. |
CVE-2022-1767 | High | 7.5 | 2022-05-18 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7. |
CVE-2022-1727 | High | 8.8 | 2022-05-18 | Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6. |
CVE-2022-1711 | High | 7.5 | 2022-05-17 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5. |
CVE-2022-1723 | High | 7.5 | 2022-05-17 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6. |
CVE-2022-1722 | Low | 3.3 | 2022-05-16 | SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses |
CVE-2022-1721 | High | 7.5 | 2022-05-16 | Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application. |
CVE-2022-1713 | High | 7.5 | 2022-05-16 | SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak… |
CVE-2022-1575 | Critical | 9.6 | 2022-05-05 | Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. -… |
CVE-2019-13127 | Medium | 6.1 | 2019-07-01 | An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Improper input vali… |
CVE-2017-18197 | Critical | 9.8 | 2018-02-24 | In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attack… |