jgraph vulnerabilities
37 published CVEs name jgraph among the affected products.
- 37Published CVEs37 of them scored
- 11Last 12 monthspublished in the last year
- 4Critical13 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-115762
draw.io: Prototype pollution in GraphML (mxGraphMlCodec)
jgraph · drawio
Medium6.1 - CVE-2026-97373
draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts
jgraph · drawio
Medium5.8 - CVE-2026-119333
draw.io Desktop allows Windows executable search-path hijacking
jgraph · drawio-desktop
High7.8 - CVE-2026-114606
draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)
jgraph · drawio-desktop
Medium5.6 - CVE-2026-76898
draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js
jgraph · drawio
High7.7 - CVE-2026-63373
draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection
jgraph · drawio
Medium4.2 - CVE-2026-63334
draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist
jgraph · drawio
Medium6.8 - CVE-2026-63416
draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints
jgraph · drawio
Low3.7 - CVE-2026-58504
draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642
jgraph · drawio
Medium6.1 - CVE-2026-46642
draw.io: XSS via crafted cell label when opening a .drawio file
jgraph · drawio
Medium6.1