jgraph drawio-desktop up to 31.5.1 File Launch src/main/electron.js untrusted search path

Summaryinfo

A vulnerability described as critical has been identified in jgraph drawio-desktop up to 31.5.1. The impacted element is an unknown function of the file src/main/electron.js of the component File Launch. Such manipulation leads to untrusted search path. This vulnerability is uniquely identified as CVE-2026-119333. Local access is required to approach this attack. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in jgraph drawio-desktop up to 31.5.1. Affected by this issue is an unknown code block of the file src/main/electron.js of the component File Launch. The manipulation with an unknown input leads to a untrusted search path vulnerability. Using CWE to declare the problem leads to CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. Impacted is confidentiality, integrity, and availability. CVE summarizes:

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-119333 since 10/29/2026. The exploitation is known to be difficult. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1574.

Upgrading to version 31.5.2 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• jgraph

Name

• drawio-desktop

Version

• 31.5.0
• 31.5.1

License

• open-source

Website

• Product: https://github.com/jgraph/drawio-desktop/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion