Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-58504: draw.io can run malicious code when opening a file

CVE-2026-58504 · published 1 month ago

Summary

The draw.io diagram tool (versions before 30.2.5) can execute hidden JavaScript when a specially crafted .drawio file is opened. This could let an attacker see your diagrams, read browser storage, and perform actions as if they were you. Update draw.io to version 30.2.5 or later to stop the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
jgraph	drawio	< 30.2.5

Original advisory text

draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.addFont() in src/main/webapp/js/grapheditor/Format.js. An HTML sibling cell keeps the formatted-label path enabled while an editable=0 plain-text sibling is excluded from the merged selection style but remains in the iteration set. graph.cellRenderer.getLabelValue() returns that plain-text label without HTML encoding, and mxUtils.canConvertHtmlToSvg() parses it as HTML, bypassing the earlier CVE-2026-46642 remediation. Successful exploitation can expose diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim. This issue is fixed in version 30.2.5.

References

https://github.com/jgraph/drawio/releases/tag/v30.2.5 URL
https://github.com/jgraph/drawio/security/advisories/GHSA-c76x-r78m-phwx Vendor Advisory
https://github.com/jgraph/drawio/commit/7976c02e1b10b1687c028d82782f9f5d90a885d6 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58504... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-58504 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

CWE-116Improper Encoding or Escaping of Output

Timeline

Published21 Sep 2026

Updated4 Nov 2026

First seen21 Sep 2026

Sources

CVE-2026-58504 · NVD

CVE-2026-58504 · MITRE

CVE-2026-58504 · OSV

GHSA-c76x-r78m-phwx · GHSA

Track software like this

Free during beta