jgraph has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 5. The median CVSS is 5.8 (medium). None have a confirmed exploitation report. Most affected products: drawio (5), drawio-desktop (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.8
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Worst active — by depth score
CVE-2026-76898High· 7.7draw.io is a configurable diagramming and whiteboarding application54CVE-2026-63334Medium· 6.8draw.io is a configurable diagramming and whiteboarding application49CVE-2026-58504Medium· 6.1draw.io is a configurable diagramming and whiteboarding application46CVE-2026-63373Medium· 4.2draw.io is a configurable diagramming and whiteboarding application35CVE-2026-63416Low· 3.7draw.io is a configurable diagramming and whiteboarding application32
jgraph vulnerabilities
CVEs affecting jgraph, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-114606Medium· 5.6draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)
draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpF…
CVE-2026-58504Medium· 6.1PoCdraw.io is a configurable diagramming and whiteboarding application
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed …
CVE-2026-63416Low· 3.7PoCdraw.io is a configurable diagramming and whiteboarding application
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL …
CVE-2026-63334Medium· 6.8PoCdraw.io is a configurable diagramming and whiteboarding application
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java perfor…
CVE-2026-63373Medium· 4.2PoCdraw.io is a configurable diagramming and whiteboarding application
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever IS_GAE is f…
CVE-2026-76898High· 7.7PoCdraw.io is a configurable diagramming and whiteboarding application
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and…