CVE-2026-97373

draw.io prior to 31.1.5 contains a prototype-pollution vulnerability in the GraphML decoder. A malicious GraphML file can trigger client-side prototype pollution, which in the advisory-supported cross-site scripting chain can execute script in the draw.io origin.

In draw.io prior to 30.3.8, Utils.sanitizeUrl() checks IPv6 Unique Local Addresses by comparing text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the fc00::/7 range, including the AWS metadata range fd00:ec2::/32, is not blocked. An unauthenticated request to /embed2.js?fetch= can make the server fetch an IPv6 ULA internal resource and reflect the response to the requester.

draw.io prior to version 30.2.7 uses request.getPathInfo() in ExportProxyServlet.java to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot segments or confirming that the normalized destination remains under the configured export path. An unauthenticated request containing traversal segments can address unintended routes on the internal export server, and the servlet forwards all request headers and the request body, allowing arbitrary header injection.

draw.io prior to version 30.2.7 skips comparison of stateToken and cookieToken in the OAuth callback handler whenever IS_GAE is false, affecting self-hosted Docker and WAR deployments. An attacker can provide an authorization code for the attacker's cloud-storage identity and induce a victim to visit a callback URL, causing the victim's session to become authenticated as the attacker identity.

draw.io prior to version 30.2.7 in deployments with ENABLE_DRAWIO_PROXY=1 is vulnerable to server-side request forgery because the private-address check in Utils.sanitizeUrl() uses one DNS resolution, while ProxyServlet.java later calls URL.openConnection() and performs a second resolution. An attacker-controlled hostname can resolve to a public address during validation and then to a private, link-local, or cloud metadata address when the connection is opened.

draw.io prior to version 30.2.5 allows execution of attacker-controlled JavaScript in the draw.io origin when a crafted .drawio file is opened or imported. The vulnerability lacks HTML encoding in certain labels, bypassing the previous CVE-2026-46642 fix. An attacker can compromise diagram data, non-HttpOnly cookies, and perform same-origin actions on the victim's behalf.

The draw.io application prior to version 29.7.12 contains a vulnerability that allows arbitrary JavaScript execution through a crafted .drawio file. The issue lies in the Text Format panel where the raw cell label is assigned to an element without proper sanitization.

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com, which can lead to credential phishing and session state token exfiltration. This issue has been patched in version 29.7.9.