CVE-2026-58504
draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642
Description
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.addFont() in src/main/webapp/js/grapheditor/Format.js. An HTML sibling cell keeps the formatted-label path enabled while an editable=0 plain-text sibling is excluded from the merged selection style but remains in the iteration set. graph.cellRenderer.getLabelValue() returns that plain-text label without HTML encoding, and mxUtils.canConvertHtmlToSvg() parses it as HTML, bypassing the earlier CVE-2026-46642 remediation. Successful exploitation can expose diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim. This issue is fixed in version 30.2.5.
INFO
Published Date :
Sept. 21, 2026, 4:15 p.m.
Last Modified :
Sept. 21, 2026, 4:15 p.m.
Remotely Exploit :
No
Source :
GitHub_M
Solution
- Update draw.io to version 30.2.5.
- Apply vendor-provided patches or updates.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-58504 vulnerability anywhere in the article.