Product by Jgraph
Drawio
33 known vulnerabilities in Drawio (Jgraph), 0 of them actively exploited (CISA KEV).
Key figures
33
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2022-1713 | SSRF on /proxy in jgraph/drawio | 7.5 | |
| High | CVE-2022-1711 | Server-Side Request Forgery (SSRF) in jgraph/drawio | 7.5 | |
| Critical | CVE-2022-1575 | Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio | 9.6 | |
| Critical | CVE-2023-3975 | OS Command Injection in jgraph/drawio | 8.3 | |
| High | CVE-2022-1815 | Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio | 5.3 | |
| High | CVE-2022-1721 | Path Traversal in WellKnownServlet in jgraph/drawio | 7.5 | |
| Critical | CVE-2023-3974 | OS Command Injection in jgraph/drawio | 9.6 | |
| High | CVE-2022-1767 | Server-Side Request Forgery (SSRF) in jgraph/drawio | 7.5 | |
| High | CVE-2022-1784 | Server-Side Request Forgery (SSRF) in jgraph/drawio | 7.5 | |
| High | CVE-2022-1723 | Server-Side Request Forgery (SSRF) in jgraph/drawio | 7.5 | |
| High | CVE-2022-1727 | Improper Input Validation in jgraph/drawio | 8.3 | |
| High | CVE-2022-1774 | Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio | 8.2 | |
| High | CVE-2026-76898 | draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js | — | |
| Critical | CVE-2022-2014 | Code Injection in jgraph/drawio | 9.6 | |
| High | CVE-2022-3133 | OS Command Injection in jgraph/drawio | 7.0 | |
| High | CVE-2022-3065 | Improper Access Control in jgraph/drawio | 5.3 | |
| Medium | CVE-2026-63334 | draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist | 6.8 | |
| Medium | CVE-2026-58504 | draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642 | 6.1 | |
| Critical | CVE-2023-3973 | Cross-site Scripting (XSS) - Reflected in jgraph/drawio | 9.6 | |
| High | CVE-2023-3398 | Denial of Service in jgraph/drawio | 5.3 | |
| Medium | CVE-2022-3873 | Cross-site Scripting (XSS) - DOM in jgraph/drawio | 6.5 | |
| High | CVE-2022-1722 | SSRF in editor's proxy via IPv6 link-local address in jgraph/drawio | 7.5 | |
| Medium | CVE-2022-2015 | Cross-site Scripting (XSS) - Stored in jgraph/drawio | 6.1 | |
| Low | CVE-2026-63416 | draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints | 3.7 | |
| Medium | CVE-2022-1730 | Cross-site Scripting (XSS) - Stored in jgraph/drawio | 6.3 |