# cve.now: Jgraph

The newest entries naming Jgraph as an affected vendor (up to 200), of 37 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115762](https://cve.now/CVE-2026-115762.md): draw.io: Prototype pollution in GraphML (mxGraphMlCodec) (CVSS 6.1)
- [CVE-2026-97373](https://cve.now/CVE-2026-97373.md): draw.io: Incomplete SSRF blocklist in \`ProxyServlet\` / \`Utils.sanitizeUrl\`: RFC 6598 CGNAT range \`100.64.0.0/10\` is not blocked -\>… (CVSS 5.8)
- [CVE-2026-119333](https://cve.now/CVE-2026-119333.md): draw.io Desktop allows Windows executable search-path hijacking (CVSS 7.8)
- [CVE-2026-114606](https://cve.now/CVE-2026-114606.md): draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate) (CVSS 5.6)
- [CVE-2026-76898](https://cve.now/CVE-2026-76898.md): draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js (CVSS 7.7)
- [CVE-2026-63373](https://cve.now/CVE-2026-63373.md): draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection (CVSS 4.2)
- [CVE-2026-63334](https://cve.now/CVE-2026-63334.md): draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist (CVSS 6.8)
- [CVE-2026-63416](https://cve.now/CVE-2026-63416.md): draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints (CVSS 3.7)
- [CVE-2026-58504](https://cve.now/CVE-2026-58504.md): draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642 (CVSS 6.1)
- [CVE-2026-46642](https://cve.now/CVE-2026-46642.md): draw.io: XSS via crafted cell label when opening a .drawio file (CVSS 6.1)
- [CVE-2026-42195](https://cve.now/CVE-2026-42195.md): Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host (CVSS 3.4)
- [CVE-2023-3975](https://cve.now/CVE-2023-3975.md): OS Command Injection in jgraph/drawio (CVSS 8.3)
- [CVE-2023-3974](https://cve.now/CVE-2023-3974.md): OS Command Injection in jgraph/drawio (CVSS 9.6)
- [CVE-2023-3973](https://cve.now/CVE-2023-3973.md): Cross-site Scripting (XSS) - Reflected in jgraph/drawio (CVSS 9.6)
- [CVE-2023-3398](https://cve.now/CVE-2023-3398.md): Denial of Service in jgraph/drawio (CVSS 5.3)
- [CVE-2023-3026](https://cve.now/CVE-2023-3026.md): Cross-site Scripting (XSS) - Stored in jgraph/drawio (CVSS 6.5)
- [CVE-2022-3873](https://cve.now/CVE-2022-3873.md): Cross-site Scripting (XSS) - DOM in jgraph/drawio (CVSS 6.5)
- [CVE-2022-3223](https://cve.now/CVE-2022-3223.md): Cross-site Scripting (XSS) - Stored in jgraph/drawio (CVSS 4.3)
- [CVE-2022-3133](https://cve.now/CVE-2022-3133.md): OS Command Injection in jgraph/drawio (CVSS 7.0)
- [CVE-2022-3138](https://cve.now/CVE-2022-3138.md): Cross-site Scripting (XSS) - Generic in jgraph/drawio (CVSS 4.3)
- [CVE-2022-3148](https://cve.now/CVE-2022-3148.md): Cross-site Scripting (XSS) - Generic in jgraph/drawio (CVSS 5.3)
- [CVE-2022-3127](https://cve.now/CVE-2022-3127.md): Cross-site Scripting (XSS) - Stored in jgraph/drawio (CVSS 5.5)
- [CVE-2022-3065](https://cve.now/CVE-2022-3065.md): Improper Access Control in jgraph/drawio (CVSS 5.3)
- [CVE-2022-2015](https://cve.now/CVE-2022-2015.md): Cross-site Scripting (XSS) - Stored in jgraph/drawio (CVSS 6.1)
- [CVE-2022-2014](https://cve.now/CVE-2022-2014.md): Code Injection in jgraph/drawio (CVSS 9.6)
- [CVE-2022-1815](https://cve.now/CVE-2022-1815.md): Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio (CVSS 5.3)
- [CVE-2022-1784](https://cve.now/CVE-2022-1784.md): Server-Side Request Forgery (SSRF) in jgraph/drawio (CVSS 7.5)
- [CVE-2022-1730](https://cve.now/CVE-2022-1730.md): Cross-site Scripting (XSS) - Stored in jgraph/drawio (CVSS 6.3)
- [CVE-2022-1774](https://cve.now/CVE-2022-1774.md): Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio (CVSS 8.2)
- [CVE-2022-1767](https://cve.now/CVE-2022-1767.md): Server-Side Request Forgery (SSRF) in jgraph/drawio (CVSS 7.5)
- [CVE-2022-1727](https://cve.now/CVE-2022-1727.md): Improper Input Validation in jgraph/drawio (CVSS 8.3)
- [CVE-2022-1711](https://cve.now/CVE-2022-1711.md): Server-Side Request Forgery (SSRF) in jgraph/drawio (CVSS 7.5)
- [CVE-2022-1723](https://cve.now/CVE-2022-1723.md): Server-Side Request Forgery (SSRF) in jgraph/drawio (CVSS 7.5)
- [CVE-2022-1713](https://cve.now/CVE-2022-1713.md): SSRF on /proxy in jgraph/drawio (CVSS 7.5)
- [CVE-2022-1721](https://cve.now/CVE-2022-1721.md): Path Traversal in WellKnownServlet in jgraph/drawio (CVSS 7.5)
- [CVE-2022-1722](https://cve.now/CVE-2022-1722.md): SSRF in editor's proxy via IPv6 link-local address in jgraph/drawio (CVSS 7.5)
- [CVE-2022-1575](https://cve.now/CVE-2022-1575.md): Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio (CVSS 9.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/jgraph
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.