CVE-2026-115762

draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype objects, and the decoder can then assign...

CVE-2026-115762

The diagramming application draw.io is vulnerable to prototype pollution in its GraphML decoder (mxGraphMlCodec) prior to version 31.1.5 . The root cause is that attacker-controlled GraphML reference keys can target inherited object properties, allowing the decoder to assign malicious attributes ...

PT-2026-137141

draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype objects, and the decoder can then assign...