jgraph/drawio vulnerabilities

2 known vulnerabilities in jgraph/drawio from Jgraph. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  jgraph/drawio: Server-Side Request Forgery

  CVE-2022-1713May 16, 2022JgraphEPSS 9.58%

  SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information.

• 9.6 Critical severity

  jgraph/drawio: Improper Neutralization of Input During Web Page Generation

  CVE-2022-1575May 5, 2022JgraphEPSS 2.4%

  Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the web app.