CVE-2026-115762

The diagramming application draw.io is vulnerable to prototype pollution in its GraphML decoder (mxGraphMlCodec) prior to version 31.1.5 . The root cause is that attacker-controlled GraphML reference keys can target inherited object properties, allowing the decoder to assign malicious attributes ...