Executive brief
draw.io is a web-based diagramming and whiteboarding tool used to create and share diagrams. A vulnerability in versions prior to 30.2.5 allows attackers to execute malicious JavaScript by crafting a .drawio file that, when opened or imported, runs code in the application's context. Successful exploitation can expose diagram data, browser cookies, and allow attackers to perform actions on behalf of the victim.
Technical details
This stored XSS vulnerability exists in the TextFormatPanel.addFont() method in Format.js, where an HTML sibling cell with formatted-label processing is combined with a plain-text sibling (editable=0) that bypasses HTML encoding in graph.cellRenderer.getLabelValue(). The mxUtils.canConvertHtmlToSvg() function then parses the unencoded plain-text label as HTML, allowing JavaScript injection. The vulnerability is triggered when selected cells are processed during file import or opening, and can be exploited with network access to provide a malicious diagram file.
Affected products
- jgraph draw.io prior to 30.2.5
Timeline
- 2026-09-21: disclosed
- 2026-06-19: patched