CVE-2026-42195 Details
Description
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.
A vulnerability in draw.io prior to version 29.7.9 allows the GitLab server URL used during OAuth sign-in to be overridden with a crafted link. This unvalidated URL parameter redirect can lead to credential phishing and exfiltration of session state tokens. When a user clicks 'Authorize in GitLab', a popup opens on the attacker-controlled host instead of the intended GitLab site. The issue affects users of draw.io deployments, including the public instance at app.diagrams.net, who open links with the vulnerable parameter from untrusted sources.
Users can upgrade to draw.io version 29.7.9 or later, where this vulnerability is patched. Self-hosted GitLab operators must set 'enableCustomGitLabUrl: true' in their configuration to use the GitLab integration, but should be aware of the associated risks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jgraph/drawio/issues/493 | [email protected] | Issue TrackingVendor |
| https://github.com/jgraph/drawio/releases/tag/v29.7.9 | [email protected] | Release NotesVendor |
| https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jgraph draw.io | < 29.7.9 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |