CVE-2023-3975
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk77th percentile - higher than 77% of all known CVEs
Summary
There is an OS Command Injection vulnerability in the GitHub repository jgraph/drawio prior to version 21.5.0.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary system commands, potentially leading to system compromise.
Recommendation
It is recommended to upgrade to version 21.5.0 or later to mitigate this vulnerability.
Other vulnerabilities in jgraph/drawio
See all- CVE-2023-3974Critical
There is an OS Command Injection vulnerability in the GitHub repository jgraph/drawio prior to version 21.4.0.
- CVE-2023-3973Medium
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository jgraph/drawio prior to version 21.6.3.
- CVE-2023-3398High
Denial of Service vulnerability exists in the GitHub repository jgraph/drawio prior to version 18.1.3.
- CVE-2023-3026Medium
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository jgraph/drawio prior to version 21.2.8, allowing for the storage of malicious code.
Original NVD description (English source)
OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.