CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

[NEW] [medium] drawio: Vulnerability allows cross-site scripting

medium
A remote, anonymous attacker can exploit a vulnerability in drawio to conduct a cross-site scripting attack.

CSIRTS triage

vendor: drawioproduct: drawioCross-site scripting
What
A vulnerability allows a remote, anonymous attacker to conduct a cross-site scripting attack.
Who is affected
Deployments of drawio are affected.
Urgency
Remediation is medium priority due to the potential for exploitation through XSS.
Action
Update to the latest version of drawio.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch drawio

Get an email when a new drawio advisory drops — max one per day, one-click unsubscribe.

Details

Source
CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity
medium
Published
2026-07-30
Exploitation
Not in CISA KEV at last sync
Language
Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2584

Recent advisories for drawio

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

More from CERT-Bund (BSI) Security Advisories