CVE-2026-58504 draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.addFont in...

PT-2026-96147

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.2.5 Description Opening or importing a specially crafted .drawio file can lead to the execution of attacker-controlled JavaScript within the draw.io origin. This occurs when selected cells are processed by the...