Diagrams Drawio — known CVE vulnerabilities

Every CVE whose affected-product data names Diagrams Drawio, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (27)

• CVE-2023-3975 — CVSS 9.8 (critical): OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.
• CVE-2023-3974 — CVSS 9.8 (critical): OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.
• CVE-2022-1575 — CVSS 9.6 (critical): Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution…
• CVE-2022-1727 — CVSS 8.8 (high): Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6.
• CVE-2022-3133 — CVSS 7.8 (high): OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.
• CVE-2022-1711 — CVSS 7.5 (high): Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.
• CVE-2022-1784 — CVSS 7.5 (high): Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.
• CVE-2022-1815 — CVSS 7.5 (high): Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.
• CVE-2022-3065 — CVSS 7.5 (high): Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.
• CVE-2023-3398 — CVSS 7.5 (high): Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.
• CVE-2022-1713 — CVSS 7.5 (high): SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This…
• CVE-2022-1721 — CVSS 7.5 (high): Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application.
• CVE-2022-1723 — CVSS 7.5 (high): Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6.
• CVE-2022-1767 — CVSS 7.5 (high): Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.
• CVE-2026-46642 — CVSS 6.1 (medium): draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary…
• CVE-2022-1774 — CVSS 6.1 (medium): Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.
• CVE-2022-3148 — CVSS 6.1 (medium): Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.
• CVE-2022-3223 — CVSS 6.1 (medium): Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1.
• CVE-2022-3873 — CVSS 6.1 (medium): Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.
• CVE-2023-3026 — CVSS 6.1 (medium): Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.
• CVE-2023-3973 — CVSS 6.1 (medium): Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.
• CVE-2022-3138 — CVSS 6.1 (medium): Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.
• CVE-2022-3127 — CVSS 5.4 (medium): Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.
• CVE-2022-2015 — CVSS 5.4 (medium): Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.
• CVE-2022-2014 — CVSS 5.4 (medium): Code Injection in GitHub repository jgraph/drawio prior to 19.0.2.
• CVE-2022-1730 — CVSS 4.6 (medium): Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4.
• CVE-2022-1722 — CVSS 3.3 (low): SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6…