Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2023-3973: Draw.io: Hackers can inject malicious code via user-inputted diagrams
CVE-2023-3973 · published 3 years ago
Summary
A hacker could trick a user into loading a malicious diagram in Draw.io, allowing the attacker to run code on their device. Users should update to version 21.6.3 or later to fix this issue.
What to do
- Update diagrams drawio to version 21.6.3 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| diagrams | drawio |
< 21.6.3 cpe:2.3:a:diagrams:drawio:*:*:*:*:*:*:*:* |
Original advisory text
Cross-site Scripting (XSS) - Reflected in jgraph/drawio
Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.
References
- https://huntr.dev/bounties/4c1c5db5-210f-4d7e-8380-b95f88fdb78d URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3973.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-3973 Vendor Advisory
- https://github.com/jgraph/drawio/commit/1db2c2c653aa245d175d30c210239e3946bfcb95 Patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published27 Jul 2023
Updated4 Nov 2026
First seen2 Apr 2026
Track software like this
Free during beta