Diagrams
Diagrams Drawio: vulnerabilidades y CVE
Diagrams Drawio tiene 27 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE27
Últimos 12 meses1
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-46642 | Media (6.1) | 0.32% | — | 10 jun 2026 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is… |
| CVE-2023-3975 | Crítica (9.8) | 2.3% | — | 27 jul 2023 | OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0. |
| CVE-2023-3974 | Crítica (9.8) | 1.2% | — | 27 jul 2023 | OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0. |
| CVE-2023-3973 | Media (6.1) | 0.40% | — | 27 jul 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3. |
| CVE-2023-3398 | Alta (7.5) | 0.97% | — | 26 jun 2023 | Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3. |
| CVE-2023-3026 | Media (6.1) | 0.53% | — | 1 jun 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8. |
| CVE-2022-3873 | Media (6.1) | 0.67% | — | 7 nov 2022 | Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2. |
| CVE-2022-3223 | Media (6.1) | 0.78% | — | 16 sept 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1. |
| CVE-2022-3133 | Alta (7.8) | 1.2% | — | 9 sept 2022 | OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0. |
| CVE-2022-3148 | Media (6.1) | 0.66% | — | 8 sept 2022 | Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0. |
| CVE-2022-3138 | Media (6.1) | 0.66% | — | 8 sept 2022 | Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0. |
| CVE-2022-3127 | Media (5.4) | 0.63% | — | 5 sept 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8. |
| CVE-2022-3065 | Alta (7.5) | 1.3% | — | 2 sept 2022 | Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8. |
| CVE-2022-2015 | Media (5.4) | 0.64% | — | 9 jun 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2. |
| CVE-2022-2014 | Media (5.4) | 0.73% | — | 9 jun 2022 | Code Injection in GitHub repository jgraph/drawio prior to 19.0.2. |
| CVE-2022-1815 | Alta (7.5) | 5.4% | — | 25 may 2022 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2. |
| CVE-2022-1784 | Alta (7.5) | 1.8% | — | 20 may 2022 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8. |
| CVE-2022-1730 | Media (4.6) | 0.61% | — | 19 may 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4. |
| CVE-2022-1774 | Media (6.1) | 1.2% | — | 18 may 2022 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7. |
| CVE-2022-1767 | Alta (7.5) | 1.8% | — | 18 may 2022 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7. |
| CVE-2022-1727 | Alta (8.8) | 1.4% | — | 18 may 2022 | Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6. |
| CVE-2022-1711 | Alta (7.5) | 5.9% | — | 17 may 2022 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5. |
| CVE-2022-1723 | Alta (7.5) | 1.7% | — | 17 may 2022 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6. |
| CVE-2022-1722 | Baja (3.3) | 0.54% | — | 16 may 2022 | SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses |
| CVE-2022-1721 | Alta (7.5) | 2.2% | — | 16 may 2022 | Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application. |
| CVE-2022-1713 | Alta (7.5) | 9.6% | — | 16 may 2022 | SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information. |
| CVE-2022-1575 | Crítica (9.6) | 2.4% | — | 5 may 2022 | Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the web app. |