Jgraph - vulnerabilities (CVEs)

37 CVEs in 4 products, 1 in the last 30 days, newest from 2026-10-22.

Products

• Jgraphdrawio - 26 CVEs
• Drawio - 7 CVEs
• Mxgraph - 3 CVEs
• Drawio-desktop - 1 CVEs

Newest CVEs of Jgraph

• CVE-2026-114606 - CVSS 5.6 (medium), 2026-10-22: draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the…
• CVE-2026-76898 - CVSS 7.7 (high), 2026-09-21: draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique…
• CVE-2026-63373 - CVSS 4.2 (medium), 2026-09-21: draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in…
• CVE-2026-63334 - CVSS 6.8 (medium), 2026-09-21: draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to…
• CVE-2026-63416 - CVSS 3.7 (low), 2026-09-21: draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses…
• CVE-2026-58504 - CVSS 6.1 (medium), 2026-09-21: draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute…
• CVE-2026-46642 - CVSS 6.1 (medium), 2026-06-10: draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the…
• CVE-2026-42195 - CVSS 3.4 (low), 2026-05-08: draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that…
• CVE-2023-3974 - CVSS 9.8 (critical), 2023-07-27: OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.
• CVE-2023-3973 - CVSS 9.6 (critical), 2023-07-27: Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.
• CVE-2023-3975 - CVSS 9.8 (critical), 2023-07-27: OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.
• CVE-2023-3398 - CVSS 7.5 (high), 2023-06-26: Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.
• CVE-2023-3026 - CVSS 6.5 (medium), 2023-06-01: Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.
• CVE-2022-3873 - CVSS 6.5 (medium), 2022-11-07: Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.
• CVE-2022-40440 - CVSS 6.1 (medium), 2022-10-12: mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.
• CVE-2022-3223 - CVSS 6.1 (medium), 2022-09-16: Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1.
• CVE-2022-3133 - CVSS 7.8 (high), 2022-09-09: OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.
• CVE-2022-3138 - CVSS 6.1 (medium), 2022-09-08: Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.
• CVE-2022-3148 - CVSS 6.1 (medium), 2022-09-08: Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.
• CVE-2022-3127 - CVSS 5.5 (medium), 2022-09-05: Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.
• CVE-2022-3065 - CVSS 7.5 (high), 2022-09-02: Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.
• CVE-2022-2015 - CVSS 6.1 (medium), 2022-06-09: Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.
• CVE-2022-2014 - CVSS 9.6 (critical), 2022-06-09: Code Injection in GitHub repository jgraph/drawio prior to 19.0.2.
• CVE-2022-1815 - CVSS 7.5 (high), 2022-05-25: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.
• CVE-2022-1784 - CVSS 7.5 (high), 2022-05-20: Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.
• CVE-2022-1730 - CVSS 6.3 (medium), 2022-05-19: Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4.
• CVE-2022-1774 - CVSS 8.2 (high), 2022-05-18: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.
• CVE-2022-1767 - CVSS 7.5 (high), 2022-05-18: Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.
• CVE-2022-1727 - CVSS 8.8 (high), 2022-05-18: Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6.
• CVE-2022-1711 - CVSS 7.5 (high), 2022-05-17: Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.