CVE-2026-119333

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the...

CVE-2026-119333

Prior to version 31.5.2 , draw.io Desktop on Windows is vulnerable to a search-path hijacking issue in src/main/electron.js . The application launched powershell and attrib using bare executable names. When a user opens a diagram from File Explorer, the diagram directory becomes the current worki...

EUVD-2026-114398

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the...