Is CVE-2026-58504 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58504 being exploited in the wild.

How severe is CVE-2026-58504?

Medium severity, with a CVSS score of 6.1, published 21 September 2026.

Which products and versions are affected?

JGraph Draw.Io prior to 30.2.5.

Is there a fix for CVE-2026-58504?

A patch was published on 2026-06-19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58504 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-58504?

Check whether you run JGraph Draw.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58504: draw.io stored XSS via crafted .drawio file in TextFormatPanel

CVE-2026-58504 · Severity: medium · CVSS 6.1 · Published 2026-09-21

draw.io is a web-based diagramming and whiteboarding tool used to create and share diagrams. A vulnerability in versions prior to 30.2.5 allows attackers to execute malicious JavaScript by crafting a .drawio file that, when opened or imported, runs code in the application's context. Successful exploitation can expose diagram data, browser cookies, and allow attackers to perform actions on behalf of the victim.

Technologies: JGraph Draw.Io. Vendors: JGraph.

Quick answers

Is CVE-2026-58504 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58504 being exploited in the wild.
How severe is CVE-2026-58504?: Medium severity, with a CVSS score of 6.1, published 21 September 2026.
Which products and versions are affected?: JGraph Draw.Io prior to 30.2.5.
Is there a fix for CVE-2026-58504?: A patch was published on 2026-06-19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58504 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-58504?: Check whether you run JGraph Draw.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This stored XSS vulnerability exists in the TextFormatPanel.addFont() method in Format.js, where an HTML sibling cell with formatted-label processing is combined with a plain-text sibling (editable=0) that bypasses HTML encoding in graph.cellRenderer.getLabelValue(). The mxUtils.canConvertHtmlToSvg() function then parses the unencoded plain-text label as HTML, allowing JavaScript injection. The vulnerability is triggered when selected cells are processed during file import or opening, and can be exploited with network access to provide a malicious diagram file.

Affected products

jgraph draw.io prior to 30.2.5

Timeline

2026-09-21: disclosed
2026-06-19: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.