Is CVE-2026-115762 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115762 being exploited in the wild.

How severe is CVE-2026-115762?

Medium severity, with a CVSS score of 6.1, published 4 November 2026.

Which products and versions are affected?

JGraph Draw.Io prior to 31.1.5.

Is there a fix for CVE-2026-115762?

Yes: fixed in 31.1.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115762 attacked?

It is attacked over the network.

Am I affected by CVE-2026-115762?

Check whether you run JGraph Draw.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115762: draw.io prototype pollution in GraphML decoder

CVE-2026-115762 · Severity: medium · CVSS 6.1 · Published 2026-11-04

draw.io is a diagramming and whiteboarding application that users can open files in to create and edit diagrams. A prototype pollution vulnerability in its GraphML file decoder allows an attacker to craft a malicious GraphML file that, when imported, pollutes JavaScript object prototypes. When combined with the Trello integration feature, this pollution can lead to arbitrary script execution with access to the user's draw.io session and stored credentials.

Technologies: JGraph Draw.Io. Vendors: JGraph.

Quick answers

Is CVE-2026-115762 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115762 being exploited in the wild.
How severe is CVE-2026-115762?: Medium severity, with a CVSS score of 6.1, published 4 November 2026.
Which products and versions are affected?: JGraph Draw.Io prior to 31.1.5.
Is there a fix for CVE-2026-115762?: Yes: fixed in 31.1.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115762 attacked?: It is attacked over the network.
Am I affected by CVE-2026-115762?: Check whether you run JGraph Draw.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 31.1.5

Technical details

The mxGraphMlCodec decoder improperly validates GraphML reference keys, allowing attacker-controlled keys like "__proto__" to target JavaScript object prototypes. When processing GraphML attributes, the decoder assigns user-supplied values to these prototype objects without sanitization. An attacker can chain this with the Trello integration to execute arbitrary JavaScript code in the draw.io origin; the Trello integration does not require a prior authentication and will execute after file import if triggered through the menu.

Affected products

jgraph draw.io prior to 31.1.5

Timeline

2026-07-29: disclosed
2026-07-29: patched: 31.1.5 released
2026-11-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.