CVE-2023-3974
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
There is an OS Command Injection vulnerability in the GitHub repository jgraph/drawio prior to version 21.4.0.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary system commands, potentially leading to system compromise.
Recommendation
It is recommended to upgrade to version 21.4.0 or later to mitigate this vulnerability.
Other vulnerabilities in jgraph/drawio
See all- CVE-2023-3975Critical
There is an OS Command Injection vulnerability in the GitHub repository jgraph/drawio prior to version 21.5.0.
- CVE-2023-3973Medium
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository jgraph/drawio prior to version 21.6.3.
- CVE-2023-3398High
Denial of Service vulnerability exists in the GitHub repository jgraph/drawio prior to version 18.1.3.
- CVE-2023-3026Medium
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository jgraph/drawio prior to version 21.2.8, allowing for the storage of malicious code.
Original NVD description (English source)
OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.