CVE-2026-58504
Received Received - Intake

Stored XSS in draw.io via Crafted .drawio File Processing

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.addFont() in src/main/webapp/js/grapheditor/Format.js. An HTML sibling cell keeps the formatted-label path enabled while an editable=0 plain-text sibling is excluded from the merged selection style but remains in the iteration set. graph.cellRenderer.getLabelValue() returns that plain-text label without HTML encoding, and mxUtils.canConvertHtmlToSvg() parses it as HTML, bypassing the earlier CVE-2026-46642 remediation. Successful exploitation can expose diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim. This issue is fixed in version 30.2.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-58504
EUVD
EUVD-2026-83987

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
jgraph draw.io 30.2.5
jgraph draw.io to 30.0.4 (exc)
draw.io draw.io 30.2.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-58504 is a stored Cross-Site Scripting (XSS) vulnerability in draw.io versions 30.0.4 and earlier. It allows an attacker to execute arbitrary JavaScript in the draw.io instance when a victim opens a crafted .drawio file. The attack involves a malicious file with two cells: one with html=1 and another with editable=0 and html=0 containing an XSS payload. When the victim selects all cells, the Format panel processes them, executing the payload due to improper sanitization of non-HTML cells.

Detection Guidance

Detecting this vulnerability requires checking the installed version of draw.io. If your version is 30.0.4 or earlier, it is vulnerable. Use commands like 'dpkg -l draw.io' on Debian-based systems or 'rpm -qa | grep draw.io' on RPM-based systems to check the installed version.

Impact Analysis

This vulnerability can expose diagram data, browser storage, non-HttpOnly cookies, and allow same-origin actions on behalf of the victim. Attackers could steal session tokens, access localStorage, or perform actions as the user without their knowledge.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, including session tokens, browser storage, and non-HttpOnly cookies. For GDPR, this may result in unauthorized data access or processing, violating principles of data protection and user consent. For HIPAA, exposure of protected health information through XSS could breach confidentiality requirements.

Mitigation Strategies

Immediately update draw.io to version 30.2.5 or later. Remove any untrusted .drawio files from your system. Avoid opening .drawio files from unknown or untrusted sources until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58504. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart