CVE-2026-119333
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In draw.io Desktop prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name. When draw.io was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved first.
Risk Assessment
A victim who extracts an attacker-supplied archive and opens its legitimate .drawio file can execute attacker-controlled code. This requires Local Fonts to be enabled or draft or backup attributes to be updated.
Recommendation
Update draw.io Desktop to version 31.5.2 or later. Avoid opening .drawio files from untrusted archives, especially when other executable files are present in the directory.
Other vulnerabilities in draw.io Desktop
Original NVD description (English source)
draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS