drawio
v32.6.10draw.io is a JavaScript, client-side editor for general diagramming.
- Maintenance
- Active21 commits in 3 months · bus factor 1
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 17 advisories1 high, 14 medium, 2 low · Scorecard 3.4/10
- Supported versions
- No scheduleendoflife.date does not track this project
9.4k stars · 1.4k forks · 42 open issues · last release 10 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 17 most recent advisories published by the maintainers: 1 high, 14 medium, 2 low. Check the patched version against the one you run.
- mediumGHSA-55cm-f4p8-xq88Oct 31, 2026ReDoS in the editableCssRules style of SVG images
- Affected
- <= 32.6.8
- mediumGHSA-ff67-v9r9-6877Sep 16, 2026Attacker-controlled export URL can exfiltrate complete diagram XML
- Affected
- <=31.4.5
- Patched in
- >=31.4.6
- mediumGHSA-v2pv-rjf8-9w9vSep 16, 2026gpt-url query injection can exfiltrate stored GPT API keys and diagram context
- Affected
- <= 31.4.5
- Patched in
- >=31.4.6
- mediumGHSA-w9xf-933m-9g4mSep 7, 2026Security Vulnerabilities (SCA) found in webapp backend dependencies (fileupload, commons-io, lang3)
- Affected
- <31.4.4
- Patched in
- >=31.4.4
- mediumGHSA-xj4f-x55f-699cSep 6, 2026IPv6 transition address bypass of validatedAddress SSRF guard in proxy and embed endpoints
- Affected
- <=31.4.2
- Patched in
- >=31.4.3
- mediumGHSA-r85c-2h2r-46rwSep 4, 2026Denial of Service via Missing Connection Timeout in ExportProxyServlet
- Affected
- <= 31.4.0
- Patched in
- >= 31.4.1
- mediumGHSA-34m6-jq4j-m83mAug 20, 2026CSS image-set() bypasses draw.io's label CSS filter, enabling DOM-secret exfiltration and an on-view beacon from the page that renders the diagram
- Affected
- <= 31.1.8
- Patched in
- >=31.3.1
- highCVE-2026-76898Aug 20, 2026Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js
- Affected
- <30.2.7
- Patched in
- >=31.1.3
- mediumCVE-2026-115762Jul 29, 2026Prototype pollution in GraphML (mxGraphMlCodec)
- Affected
- <31.1.5
- Patched in
- 31.1.5
- mediumCVE-2026-97373Jul 14, 2026Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts
- Affected
- <= 29.6.4
- Patched in
- >= 30.3.8
- mediumGHSA-ghcc-x248-vj2jJul 14, 2026Denial of Service via Extreme Cell Coordinates in mxGraph.updatePageBreaks
- Affected
- <= 30.3.6
- Patched in
- >= 30.3.8
- lowCVE-2026-63416Jun 30, 2026Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints
- Affected
- <= v30.2.6
- mediumCVE-2026-63373Jun 30, 2026OAuth CSRF via missing state validation on self-hosted deployments allows session token injection
- Affected
- <= v30.2.6
- mediumCVE-2026-63334Jun 30, 2026SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist
- Affected
- <= v30.2.6
- mediumCVE-2026-58504Jun 19, 2026Stored XSS on file open via editable=0 sibling cell — patch bypass of GHSA-fqhg-287p-c6vf
- Affected
- 30.2.4
- Patched in
- 30.2.5
- mediumCVE-2026-46642May 15, 2026XSS via crafted cell label when opening a .drawio file
- Affected
- <= 29.7.11
- Patched in
- 29.7.12
- lowCVE-2026-42195Apr 20, 2026Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host
- Affected
- < 29.7.8
- Patched in
- 29.7.9