CVE-2026-58504 Details
Description
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.addFont() in src/main/webapp/js/grapheditor/Format.js. An HTML sibling cell keeps the formatted-label path enabled while an editable=0 plain-text sibling is excluded from the merged selection style but remains in the iteration set. graph.cellRenderer.getLabelValue() returns that plain-text label without HTML encoding, and mxUtils.canConvertHtmlToSvg() parses it as HTML, bypassing the earlier CVE-2026-46642 remediation. Successful exploitation can expose diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim. This issue is fixed in version 30.2.5.
A stored cross-site scripting vulnerability has been identified in draw.io versions prior to 30.2.5. The issue arises when a user opens or imports a specially crafted .drawio file. The vulnerability is triggered as the selected cells are processed by the TextFormatPanel.addFont() function, located in Format.js. This process allows attacker-controlled JavaScript to execute in the context of the draw.io application. The exploitation takes advantage of how different cell types are handled, particularly plain-text cells with specific attributes, bypassing previous security measures.
Users should update to draw.io version 30.2.5 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jgraph/drawio/commit/7976c02e1b10b1687c028d82782f9f5d90a885d6 | [email protected] | Source CodeVendor |
| https://github.com/jgraph/drawio/releases/tag/v30.2.5 | [email protected] | Release NotesVendor |
| https://github.com/jgraph/drawio/security/advisories/GHSA-c76x-r78m-phwx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| draw.io | 30.2.4 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | New CVE Received | [email protected] |