CVE-2026-46642 draw.io: XSS via crafted cell label when opening a .drawio file
Attackers can execute arbitrary JavaScript in draw.io by tricking users into opening a crafted .drawio file, potentially compromising the application context.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-46642?
CVE-2026-46642 is a medium-severity cross-site scripting vulnerability in jgraph drawio, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer (which works correctly on the rendering path) but in a feature-detection routine in the Text Format panel that reads the raw cell label and assigns it to a detached element's innerHTML without sanitization. Browsers fire onerror for failed image loads even on detached elements, so an <img src=x onerror=...> payload in any cell label triggers script execution as soon as the cell is selected — which import does automatically. This issue has been patched in version 29.7.12.
Weakness: CWE-79
Which versions are affected by CVE-2026-46642?
It affects 1 product.
Products include Diagrams Drawio.
How do I fix CVE-2026-46642?
No fix has been published for CVE-2026-46642 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-46642 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-46642 exists.
Other vulnerabilities in jgraph drawio
- CVE-2023-3973 Cross-site Scripting (XSS) - Reflected in jgraph/drawio
- CVE-2023-3974 OS Command Injection in jgraph/drawio
- CVE-2022-2014 Code Injection in jgraph/drawio
- CVE-2022-1575 Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio
- CVE-2023-3975 OS Command Injection in jgraph/drawio
Sources
Also known as GHSA-fqhg-287p-c6vf.