CVE-2023-3973

MediumCVSS 6.1

Published: 27/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

26th percentile - higher than 26% of all known CVEs

A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository jgraph/drawio prior to version 21.6.3.

An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.

It is recommended to upgrade to version 21.6.3 or later to mitigate this vulnerability.

Original NVD description (English source)

Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.