CVE-2026-46642 Details
Description
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer (which works correctly on the rendering path) but in a feature-detection routine in the Text Format panel that reads the raw cell label and assigns it to a detached element's innerHTML without sanitization. Browsers fire onerror for failed image loads even on detached elements, so an <img src=x onerror=...> payload in any cell label triggers script execution as soon as the cell is selected — which import does automatically. This issue has been patched in version 29.7.12.
A cross-site scripting (XSS) vulnerability has been identified in draw.io versions prior to 29.7.12. When a .drawio file containing a specific payload is opened, it can execute arbitrary JavaScript in the editor's origin. This issue arises from a feature-detection routine in the Text Format panel, which reads raw cell labels and assigns them to a detached element's innerHTML without proper sanitization. As a result, an image payload with an onerror attribute can trigger script execution as soon as the cell is selected, a process that occurs automatically upon importing the file.
Users can upgrade to draw.io version 29.7.12 or later, where this vulnerability has been fixed. For those unable to upgrade immediately, it is recommended to set a Content-Security-Policy that blocks inline event handlers, such as 'Content-Security-Policy: script-src 'self''. This policy is already applied by the draw.io static deployment at 'https://jgraph.github.io/drawio/'.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jgraph/drawio/security/advisories/GHSA-fqhg-287p-c6vf | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/jgraph/drawio/releases/tag/v29.7.12 | [email protected] | Release Notes |
| https://github.com/jgraph/drawio/security/advisories/GHSA-fqhg-287p-c6vf | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| diagrams drawio | < 29.7.12 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| Jun 11, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |