Description

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.addFont() in src/main/webapp/js/grapheditor/Format.js. An HTML sibling cell keeps the formatted-label path enabled while an editable=0 plain-text sibling is excluded from the merged selection style but remains in the iteration set. graph.cellRenderer.getLabelValue() returns that plain-text label without HTML encoding, and mxUtils.canConvertHtmlToSvg() parses it as HTML, bypassing the earlier CVE-2026-46642 remediation. Successful exploitation can expose diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim. This issue is fixed in version 30.2.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-21T17:17:36.077Z",
  "pubdate": "2026-09-21T17:17:36.077Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in draw.io prior to version 30.2.5, originating from improper handling of crafted .drawio files.\nThe vulnerability allows an attacker to execute arbitrary JavaScript within the draw.io origin when a victim imports or opens a malicious diagram file.\nThis flaw is triggered when the application processes selected cells via the TextFormatPanel.addFont() function.\nSuccessful exploitation compromises the confidentiality and integrity of the user's session, enabling the exfiltration of diagram data, browser storage, and non-HttpOnly cookies.\nThe issue stems from a bypass of the previously implemented CVE-2026-46642 remediation, as specific logic within the cell selection iteration fails to sanitize labels retrieved by graph.cellRenderer.getLabelValue().\nNo authentication or elevated privileges are required for an attacker to craft a payload, as the attack is delivered via a file-based vector, making it a critical risk for users handling untrusted diagram files.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient sanitization process within the cell selection iteration logic, specifically involving the interaction between complex cell hierarchies and the TextFormatPanel component.\nWhen a user selects multiple cells, the application's processing logic in src/main/webapp/js/grapheditor/Format.js, specifically within TextFormatPanel.addFont(), iterates through the selection set to apply formatting.\nThe vulnerability is triggered by creating a carefully structured .drawio file containing a composite object. This object includes an HTML-formatted sibling cell—which maintains an active formatted-label path—and an editable=0 plain-text sibling cell.\nDuring the iteration process, the logic incorrectly includes the plain-text sibling in the iteration set, even though it is excluded from the merged selection style. The function graph.cellRenderer.getLabelValue() is then invoked to retrieve the value of this plain-text label.\nCrucially, the returned value is not subjected to necessary HTML encoding before processing. Subsequently, mxUtils.canConvertHtmlToSvg() receives this raw string and parses it as HTML. Because the previous remediation (CVE-2026-46642) relied on specific parsing assumptions that do not account for this atypical grouping of HTML-enabled and plain-text cells, the parser effectively 'promotes' the malicious payload into the DOM.\nAn attacker can exploit this by injecting a malicious script tag or an event-based payload (e.g., onerror attributes within an SVG context) into the plain-text label field. When the affected version of draw.io parses this label as HTML, the script executes immediately within the draw.io origin.\nThe impact is significant: the execution environment possesses full access to the Document Object Model (DOM) of the page. This allows the script to read sensitive diagram data, access Web Storage (localStorage/sessionStorage), and steal non-HttpOnly cookies, potentially leading to session hijacking. Furthermore, the script can perform any same-origin action permitted to the authenticated user, such as programmatically modifying diagrams, exporting data, or interacting with third-party integrations connected to the draw.io instance."
}