CVE-2022-1575

Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary remote code execution in the desktop app. - Stored XSS in the web app...

CVE-2022-1711

Server-Side Request Forgery SSRF in GitHub repository jgraph/drawio prior to 18.0.5...

CVE-2022-2014

Code Injection in GitHub repository jgraph/drawio prior to 19.0.2...

The vulnerability of the drawio diagram-building software lies in the improper neutralization of special elements used in the OS command. This allows a hacker to execute arbitrary commands.

The vulnerability of the software for creating Drawio diagrams is related to the improper neutralization of special elements used in the OS command. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

ROS-20241203-21

The vulnerability of drawio diagramming software is related to improper neutralization of the of special elements used in the OS command. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute arbitrary commands...

CVE-2023-3973

Cross-site Scripting XSS - Reflected in GitHub repository jgraph/drawio prior to 21.6.3...

CVE-2023-3974

OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0...

CVE-2023-3975

OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0...

Command injection

OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0...

CVE-2023-3975 OS Command Injection in jgraph/drawio

OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0...

CVE-2023-3975 OS Command Injection in jgraph/drawio

OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0...

CVE-2023-3975

CVE-2023-3975 affects jgraph/drawio before 21.5.0, with an OS command injection vulnerability. Public descriptions indicate an insecure configuration pathway where crafted library previews and IPC/DS mechanisms enable execution of arbitrary commands on the host. The connected material outlines an...

CVE-2023-3975 OS Command Injection in jgraph/drawio

OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0...

CVE-2023-3974 OS Command Injection in jgraph/drawio

OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0...

CVE-2023-3974

The CVE-2023-3974 issue affects jgraph/drawio prior to 21.4.0, where saving drafts in the desktop app can trigger an OS command injection due to using spawn with shell: true. The Red Hat/NVD entries describe OS command injection risk with the affected desktop release, and PoCs illustrate commands...

CVE-2023-3974 OS Command Injection in jgraph/drawio

OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0...

CVE-2023-3974 OS Command Injection in jgraph/drawio

OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0...

CVE-2023-3973 Cross-site Scripting (XSS) - Reflected in jgraph/drawio

Cross-site Scripting XSS - Reflected in GitHub repository jgraph/drawio prior to 21.6.3...

CVE-2023-3973 Cross-site Scripting (XSS) - Reflected in jgraph/drawio

Cross-site Scripting XSS - Reflected in GitHub repository jgraph/drawio prior to 21.6.3...

CVE-2023-3973

CVE-2023-3973 is a cross-site scripting (XSS) vulnerability reported as a reflected XSS in jgraph/drawio prior to version 21.6.3. Multiple sources in the connected set describe an XSS vector that can be triggered via user-controlled labels and plugin handling, including HTML decoding and injectio...