jgraph drawio up to 29.7.11 cross site scripting

Summaryinfo

A vulnerability has been found in jgraph drawio up to 29.7.11 and classified as problematic. The affected element is an unknown function. Performing a manipulation results in cross site scripting. This vulnerability was named CVE-2026-46642. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in jgraph drawio up to 29.7.11. This affects an unknown part. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer (which works correctly on the rendering path) but in a feature-detection routine in the Text Format panel that reads the raw cell label and assigns it to a detached element's innerHTML without sanitization. Browsers fire onerror for failed image loads even on detached elements, so an payload in any cell label triggers script execution as soon as the cell is selected — which import does automatically. This issue has been patched in version 29.7.12.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-46642 since 05/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Upgrading to version 29.7.12 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• jgraph

Name

• drawio

Version

• 29.7.0
• 29.7.1
• 29.7.2
• 29.7.3
• 29.7.4
• 29.7.5
• 29.7.6
• 29.7.7
• 29.7.8
• 29.7.9
• 29.7.10
• 29.7.11

License

• open-source

Website

• Product: https://github.com/jgraph/drawio/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion