CVE-2026-46642

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 29.7.12

Description A crafted .drawio file can execute arbitrary JavaScript in the editor's origin when opened. The issue exists in a feature-detection routine within the Text Format panel that reads the raw cell label and assigns it to a detached element's innerHTML without sanitization. Because browsers trigger the onerror event for failed image loads even on detached elements, a payload such as <img src=x onerror=...> in any cell label triggers script execution immediately upon cell selection, which occurs automatically during import.

Recommendations Update to version 29.7.12.