SZB-acc67e8f8d
EUVD lists draw.io Desktop Windows executable-lookup flaw (EUVD-2026-114398)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- draw.io
- Product
- draw.io Desktop
- First seen
Summary
The EUVD entry, as relayed on Mastodon, says that before 31.5.2 the Windows app launched powershell and attrib by bare executable name, and opening a diagram while the app was not running may have been involved. It gives a CVSS v3.1 score of 7.8/10; the visible text is truncated, so the exact trigger is not confirmed here.
If you use draw.io
Update draw.io Desktop to 31.5.2 or later
Avoid opening diagrams from untrusted sources until updated
What the sources say 1
· Mastodon: “Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js.” Source