CVE-2026-46642: draw.io XSS Vulnerability – Patch to 29.7.12

Technical summary

The vulnerability exists in draw.io's Text Format panel feature-detection code, which retrieves raw cell label content and assigns it directly to a detached DOM element's innerHTML property without sanitization. A specially crafted cell label containing img elements with onerror handlers—e.g., <img src=x onerror="malicious_code()"—bypasses the application's normal label sanitizer because the code path diverges from the standard rendering pipeline. Browsers fire onerror events even for image load failures on detached elements. When a user opens a malicious .drawio file, import triggers automatic cell selection, firing the onerror event and executing the embedded payload in the origin of the editor application. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, or Cross-site Scripting).

Business impact

A compromised or malicious diagram file can execute code within the draw.io editor's security context, potentially allowing an attacker to steal session tokens, modify diagrams, exfiltrate sensitive information displayed in open diagrams, or pivot to other web applications sharing the same origin. Organizations using draw.io for collaborative technical or business documentation workflows face data confidentiality and integrity risks if users download and open untrusted diagram files. Teams working with externally sourced diagrams or those shared via email or public repositories are most exposed. The risk is heightened in enterprises where diagram files are treated as trusted content despite potential tampering during transit or storage.

Affected systems

draw.io versions prior to 29.7.12 are affected. This includes both the standalone application and any deployment of the draw.io codebase integrated into other platforms. Users running draw.io as a web application, desktop client, or embedded service should verify their version and apply the patch. The vulnerability is triggered on file open, so any user or process that imports a .drawio file is at risk.

Exploitability

Exploitability is straightforward: an attacker crafts a .drawio file containing malicious JavaScript in a cell label and distributes it via email, file sharing, or public repository. When a user opens the file, the payload executes automatically during import without requiring additional interaction beyond the file-open action. No special configuration or unusual browser settings are needed. The CVSS score of 6.1 (MEDIUM) reflects the requirement for user interaction (opening the file) and the limited scope of impact, but the ease of weaponization—diagram files are common business artifacts—warrants serious attention. The vulnerability is not currently known to be exploited in the wild according to available intelligence.

Remediation

Upgrade draw.io to version 29.7.12 or later. This release patches the Text Format panel code to sanitize cell labels before inserting them into the DOM, closing the onerror execution path. No workaround is available for earlier versions other than restricting file imports to trusted, verified sources and avoiding opening .drawio files from untrusted parties. Organizations should audit file-sharing practices and educate users to validate the origin of diagram files before importing.

Patch guidance

Apply version 29.7.12 or any subsequent release. Verify the update through your draw.io deployment channel: if you use the official web application, check that your version number reflects 29.7.12 or later via the About or Help menu. For self-hosted or embedded instances, consult your deployment vendor or the draw.io GitHub repository for the patched source code and rebuild/redeploy accordingly. Test the patched version in a non-production environment first, particularly if draw.io is integrated into a larger platform.

Detection guidance

Monitor for .drawio files opened in your environment, especially from external or untrusted sources. Review web server and application logs for unusual JavaScript execution patterns or errors related to draw.io sessions. Browser-based detection is difficult because the payload executes within the application sandbox, but behavioral monitoring tools can flag unexpected network activity or credential access correlated with draw.io editor sessions. For file-based detection, scan .drawio files (which are XML-based) for img tags containing onerror attributes, particularly those with inline scripts or suspicious function calls. Endpoint detection and response (EDR) tools should monitor for code execution initiated by the draw.io process or browser tab.

Why prioritize this

While the CVSS score is MEDIUM (6.1), the vulnerability merits prompt but measured attention. The attack surface is low—users must open a malicious file—but the likelihood of targeted distribution is moderate given that diagram files are routine business communication artifacts. Organizations should prioritize patching in the following order: (1) environments where users frequently receive diagrams from external parties, (2) instances exposed to the internet, (3) all remaining instances. The lack of KEV (Known Exploited Vulnerability) status and current absence of public exploits reduce the urgency slightly, but patch within 30 days is reasonable.

Risk score, explained

The CVSS 3.1 score of 6.1 / MEDIUM reflects: (i) network attack vector—files can be distributed remotely; (ii) low attack complexity—no special conditions needed; (iii) no privileges required; (iv) required user interaction—file must be opened; (v) changed scope—script executes in the editor's origin and could affect other applications on that origin; (vi) low confidentiality impact—exfiltration of data visible in diagrams or session tokens; (vii) low integrity impact—ability to modify or craft diagrams; (viii) no availability impact. The score does not account for the high ease of crafting malicious payloads or the common role of diagram files in business workflows, so practitioners should consider the practical risk context alongside the score.

Frequently asked questions