CVE-2026-115762

Received Received - Intake

Prototype Pollution in draw.io via GraphML Import

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype objects, and the decoder can then assign attacker-controlled attributes to those objects. Importing a malicious GraphML file can trigger client-side prototype pollution. In the advisory-supported cross-site scripting chain, the editor is opened in Trello mode and the user invokes the Trello integration after the import, allowing the polluted state to execute script in the draw.io origin; an existing Trello connection is not required. This vulnerability is fixed in 31.1.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-115762

EUVD

EUVD-2026-117102

Affected Vendors & Products

Vendor	Product	Version / Range
jgraph	drawio	< 31.1.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

This is a prototype-pollution vulnerability in draw.io versions prior to 31.1.5. Attackers can craft malicious GraphML files with reference keys that target inherited object properties, including prototype objects. When imported, these files allow attackers to assign arbitrary attributes to those objects, enabling client-side prototype pollution.

Detection Guidance

To detect this vulnerability, check the version of draw.io installed on your system. If it is prior to 31.1.5, the system is vulnerable. You can verify the version by inspecting the application or checking the package details.

Impact Analysis

An attacker could exploit this by tricking you into importing a malicious GraphML file. If you then use the Trello integration in draw.io, the polluted state could execute malicious JavaScript in the draw.io origin, potentially stealing data or performing unauthorized actions on your behalf.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling cross-site scripting (XSS) attacks through prototype pollution. If exploited, it may lead to unauthorized data access or manipulation, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Immediately update draw.io to version 31.1.5 or later to patch the prototype pollution vulnerability. Avoid importing untrusted GraphML files until the update is applied.

Hi! I’m here to help you understand CVE-2026-115762. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...