draw.io Desktop allows Windows executable search-path hijacking
draw.io Desktop on Windows before 31.5.2 can run a program placed next to a .drawio file instead of the intended system tool. The fix is in 31.5.2.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 31.5.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
draw.io Desktop, the official Windows application for creating diagrams, is affected. An attacker could get a victim to run malicious code on their computer by placing a fake program in the same folder as a diagram file that the victim opens.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- jgraph drawio-desktop
fixed in 31.5.2
References 3
GitHub · jgraph/drawio-desktop
Questions about CVE-2026-119333
What does this mean?
On Windows, draw.io Desktop starts the PowerShell and attrib programs by bare name without a full path. Windows can then find a program with that name in the diagram's folder first and run it with the application's permissions.Source: github.com
Am I affected, and how do I check?
The facts list draw.io Desktop versions before 31.5.2 on Windows. The problem depends on the setup: the diagram is opened from File Explorer while draw.io Desktop is not already running, and a file named powershell.bat or attrib.exe sits in the same folder. To check the version, open the app's About dialog from the Help menu.Source: github.com
What should I do about it?
Upgrade draw.io Desktop to version 31.5.2 or later.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data