Jgraph vulnerabilities
37 CVEs and advisories name Jgraph as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-115762draw.io: Prototype pollution in GraphML (mxGraphMlCodec)
- CVE-2026-97373draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked ->…
- CVE-2026-119333draw.io Desktop allows Windows executable search-path hijacking
- CVE-2026-114606draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)
- CVE-2026-76898draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js
- CVE-2026-63373draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection
- CVE-2026-63334draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist
- CVE-2026-63416draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints
- CVE-2026-58504draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642
- CVE-2026-46642draw.io: XSS via crafted cell label when opening a .drawio file
- CVE-2026-42195Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host
- CVE-2023-3975OS Command Injection in jgraph/drawio
- CVE-2023-3974OS Command Injection in jgraph/drawio
- CVE-2023-3973Cross-site Scripting (XSS) - Reflected in jgraph/drawio
- CVE-2023-3398Denial of Service in jgraph/drawio
- CVE-2023-3026Cross-site Scripting (XSS) - Stored in jgraph/drawio
- CVE-2022-3873Cross-site Scripting (XSS) - DOM in jgraph/drawio
- CVE-2022-3223Cross-site Scripting (XSS) - Stored in jgraph/drawio
- CVE-2022-3133OS Command Injection in jgraph/drawio
- CVE-2022-3138Cross-site Scripting (XSS) - Generic in jgraph/drawio
- CVE-2022-3148Cross-site Scripting (XSS) - Generic in jgraph/drawio
- CVE-2022-3127Cross-site Scripting (XSS) - Stored in jgraph/drawio
- CVE-2022-3065Improper Access Control in jgraph/drawio
- CVE-2022-2015Cross-site Scripting (XSS) - Stored in jgraph/drawio
- CVE-2022-2014Code Injection in jgraph/drawio
- CVE-2022-1815Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio
- CVE-2022-1784Server-Side Request Forgery (SSRF) in jgraph/drawio
- CVE-2022-1730Cross-site Scripting (XSS) - Stored in jgraph/drawio
- CVE-2022-1774Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio
- CVE-2022-1767Server-Side Request Forgery (SSRF) in jgraph/drawio