VendorsDiagramsdrawioall versions
Vulnerabilities

Diagrams Drawio

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

27CVEs
CVE-2023-3975
OS Command Injection in jgraph/drawio
Published 2023-07-27 · Modified
9.8EPSS 0.023
CVE-2023-3974
OS Command Injection in jgraph/drawio
Published 2023-07-27 · Modified
9.8EPSS 0.012
CVE-2022-1575
Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio
Published 2022-05-05 · Modified
9.6EPSS 0.024
CVE-2022-2014
Code Injection in jgraph/drawio
Published 2022-06-08 · Modified
9.6EPSS 0.007
CVE-2023-3973
Cross-site Scripting (XSS) - Reflected in jgraph/drawio
Published 2023-07-27 · Modified
9.6EPSS 0.004
CVE-2022-1727
Improper Input Validation in jgraph/drawio
Published 2022-05-18 · Modified
8.8EPSS 0.014
CVE-2022-1774
Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio
Published 2022-05-18 · Modified
8.2EPSS 0.012
CVE-2022-3133
OS Command Injection in jgraph/drawio
Published 2022-09-09 · Modified
7.8EPSS 0.012
CVE-2022-1713
SSRF on /proxy in jgraph/drawio
Published 2022-05-16 · Modified
7.5EPSS 0.096
CVE-2022-1711
Server-Side Request Forgery (SSRF) in jgraph/drawio
Published 2022-05-17 · Modified
7.5EPSS 0.059
CVE-2022-1815
Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio
Published 2022-05-25 · Modified
7.5EPSS 0.054
CVE-2022-1721
Path Traversal in WellKnownServlet in jgraph/drawio
Published 2022-05-16 · Modified
7.5EPSS 0.022
CVE-2022-1767
Server-Side Request Forgery (SSRF) in jgraph/drawio
Published 2022-05-18 · Modified
7.5EPSS 0.018
CVE-2022-1784
Server-Side Request Forgery (SSRF) in jgraph/drawio
Published 2022-05-20 · Modified
7.5EPSS 0.018
CVE-2022-1723
Server-Side Request Forgery (SSRF) in jgraph/drawio
Published 2022-05-17 · Modified
7.5EPSS 0.017
CVE-2022-3065
Improper Access Control in jgraph/drawio
Published 2022-09-02 · Modified
7.5EPSS 0.013
CVE-2023-3398
Denial of Service in jgraph/drawio
Published 2023-06-26 · Modified
7.5EPSS 0.010
CVE-2022-1722
SSRF in editor's proxy via IPv6 link-local address in jgraph/drawio
Published 2022-05-16 · Modified
7.5EPSS 0.005
CVE-2022-3873
Cross-site Scripting (XSS) - DOM in jgraph/drawio
Published 2022-11-07 · Modified
6.5EPSS 0.007
CVE-2023-3026
Cross-site Scripting (XSS) - Stored in jgraph/drawio
Published 2023-06-01 · Modified
6.5EPSS 0.005
CVE-2022-1730
Cross-site Scripting (XSS) - Stored in jgraph/drawio
Published 2022-05-19 · Modified
6.3EPSS 0.006
CVE-2022-3223
Cross-site Scripting (XSS) - Stored in jgraph/drawio
Published 2022-09-16 · Modified
6.1EPSS 0.008
CVE-2022-3138
Cross-site Scripting (XSS) - Generic in jgraph/drawio
Published 2022-09-08 · Modified
6.1EPSS 0.006
CVE-2022-3148
Cross-site Scripting (XSS) - Generic in jgraph/drawio
Published 2022-09-08 · Modified
6.1EPSS 0.006
CVE-2022-2015
Cross-site Scripting (XSS) - Stored in jgraph/drawio
Published 2022-06-08 · Modified
6.1EPSS 0.006
CVE-2026-46642
draw.io: XSS via crafted cell label when opening a .drawio file
Published 2026-06-10 · Analyzed
6.1EPSS 0.003
CVE-2022-3127
Cross-site Scripting (XSS) - Stored in jgraph/drawio
Published 2022-09-05 · Modified
5.5EPSS 0.006