CVE-2026-58504 draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.addFont in...