CVE-2026-115762

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 31.1.5

Description The GraphML decoder allows prototype pollution, a condition where an attacker can manipulate the prototype of an object to inject properties. By using controlled GraphML reference keys, an attacker can address inherited object properties and assign arbitrary attributes to them. Importing a malicious GraphML file triggers this client-side pollution. When the editor is used in Trello mode and the Trello integration is invoked, this polluted state can be used to execute arbitrary scripts within the draw.io origin.

Recommendations Update draw.io to version 31.1.5.