By vendor

Diagrams vulnerabilities

Known CVEs affecting Diagrams products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-46642MEDIUM 6.1

  draw.io versions before 29.7.12 contain a stored cross-site scripting (XSS) vulnerability triggered when a crafted diagram file (.drawio) is opened. A malicious diagram can embed JavaScript code disguised as image markup that executes in the editor's security context as soon as the file is imported. The vulnerability stems not from the display rendering logic—which properly sanitizes content—but from a feature-detection routine in the Text Format panel that reads raw cell labels and inserts them into the DOM without validation. Attackers can craft and distribute poisoned diagram files that execute arbitrary scripts when opened by a user.