Quick answers
- Is CVE-2026-97373 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-97373 being exploited in the wild.
- How severe is CVE-2026-97373?
- Medium severity, with a CVSS score of 5.8, published 4 November 2026.
- Which products and versions are affected?
- JGraph Draw.Io prior to 30.3.8.
- Is there a fix for CVE-2026-97373?
- Yes: fixed in 30.3.8. Until then: Disable the optional /proxy endpoint by not setting ENABLE_DRAWIO_PROXY=1 unless required for legitimate use; restrict network access to the /proxy endpoint at the network perimeter to trusted clients. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-97373 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-97373?
- Check whether you run JGraph Draw.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 30.3.8
Disable the optional /proxy endpoint by not setting ENABLE_DRAWIO_PROXY=1 unless required for legitimate use; restrict network access to the /proxy endpoint at the network perimeter to trusted clients.
Technical details
The vulnerability is an incomplete server-side request forgery (SSRF) blocklist in Utils.sanitizeUrl() which validates URLs for the optional /proxy endpoint. The blocklist omits RFC 6598 CGNAT range 100.64.0.0/10, while blocking other private ranges (RFC 1918, loopback, link-local). An unauthenticated remote attacker can bypass the filter by requesting http://100.64.0.x addresses, forcing the draw.io server to fetch from internal services reachable in that range, such as EKS pod IPs, OCI internal endpoints, or Tailscale peers.
Affected products
- jgraph draw.io prior to 30.3.8
Timeline
- 2026-07-14: disclosed
- 2026-07-14: patched
- 2026-11-04: advisory