CVE-2026-119333 in drawio-desktop
Summary
by MITRE • 10/30/2026
draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in draw.io Desktop prior to version 31.5.2 represents a critical security flaw rooted in improper handling of executable paths and working directory contexts within the Electron-based application on Windows systems. This issue specifically affects users who interact with diagram files through the operating system's file explorer, particularly when launching diagrams via cold starts where no instance of draw.io Desktop is currently running. The core technical failure lies in how the application invokes external processes during specific operations such as updating draft or backup attributes or enabling local fonts. Instead of using fully qualified paths to invoke system utilities like powershell.exe and attrib.exe, the application relies on bare executable names. This design choice introduces a path traversal vulnerability where the operating system's PATH resolution mechanism is exploited due to an insecure current working directory context.
When a user opens a .drawio file from File Explorer while draw.io Desktop is not already running, the application initializes with its current working directory set to the location of the opened diagram file rather than the installation directory or a secure default path. This behavior creates a dangerous condition known as binary planting or search order hijacking. Because powershell and attrib are invoked by name without absolute paths, Windows searches for these executables starting in the current working directory before checking system directories like C:\Windows\System32. An attacker who has gained access to the same file system location as the victim can place malicious versions of powershell.bat or attrib.exe within that directory. If a user extracts an archive containing these malicious files and subsequently opens a legitimate .drawio file from that same extracted folder, the application will inadvertently execute the attacker-controlled scripts instead of the intended Windows utilities.
The operational impact of this vulnerability is significant as it allows for arbitrary code execution with the privileges of the current user. The attack vector relies on social engineering or prior access to trick the victim into opening a specific file from a malicious directory. Once triggered, either by enabling local fonts which may invoke PowerShell for font processing tasks, or during background operations that update draft and backup attributes using attrib.exe, the attacker gains control over the execution flow. This can lead to data exfiltration, installation of additional malware, or complete compromise of the user's workstation depending on what code is embedded in the malicious batch file or executable. The severity is heightened by the fact that it requires no special privileges beyond those already held by the victim and exploits a common workflow pattern involving archive extraction and file opening from external sources.
From an industry standards perspective, this vulnerability aligns with CWE-427, Uncontrolled Search Path Element, as the application fails to control which search paths are used during dynamic link library or executable resolution. It also maps closely to MITRE ATT&CK technique T1564.008, Hijack Execution Flow: Process Injection via DLL Side-Loading, although in this specific case it is more accurately described under T1204.002, User Execution: Malicious File, combined with the mechanism of search order hijacking often associated with T1574.006 or similar execution flow manipulation techniques depending on how the malicious binary is invoked. The flaw highlights a common oversight in Electron applications where security best practices for path handling are not strictly enforced during inter-process communication and system utility invocation.
Mitigation strategies primarily involve upgrading to version 31.5.2 of draw.io Desktop, which resolves this issue by ensuring that all external process invocations use fully qualified absolute paths rather than relying on the current working directory or PATH environment variable for resolution. For organizations unable to immediately patch, restricting user permissions and implementing application whitelisting can help mitigate the risk. Additionally, security awareness training should emphasize caution when opening files from untrusted archives extracted into arbitrary directories. Developers of Electron applications must adhere to strict coding standards that mandate absolute paths for all system command executions to prevent similar search order hijacking vulnerabilities in future releases.