CVE-2026-76898

draw.io prior to version 30.3.8 is vulnerable to an unauthenticated SSRF via an IPv6 ULA blocklist bypass in /embed2.js. The root cause is in Utils.sanitizeUrl(), which checks for IPv6 ULA addresses by comparing the literal text prefixes fc00:: and fd00::, but the JDK returns the expanded address...