Jgraph vulnerabilities
We track 4 vulnerabilities in Jgraph products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest Jgraph vulnerabilities
- 7.8 High severity
drawio-desktop: Untrusted Search Path
draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Expl
- 7.7 High severity
drawio: Server-Side Request Forgery
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and fd00::, but the JDK re
- 7.5 High severity
jgraph/drawio: Server-Side Request Forgery
SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information.
- 9.6 Critical severity
jgraph/drawio: Improper Neutralization of Input During Web Page Generation
Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the web app.