repository icon
jgraph / drawio Project repository

draw.io is a JavaScript, client-side editor for general diagramming.

Submit a report

FIRST INTERACTION

WITHIN1 DAY

REVIEW

WITHIN1 DAY

FIX

WITHIN7 DAYS

Insufficient checks lead to ability to bypass payment to third-party service Ope...
radl97
Medium
Overwrite native Mathjax Markdown functions via certain macros
pihunter50-test
informative
None
XSS with CSP bypass leads to diagrams backdoor
kevin-mizu
Critical
•$3000•CVE-2023-3973
HTML Injection via PlantUML (text) feature
chb9
informative
None
Open Redirect via deskDomain
p0cas
None
Desktop APP XSS to RCE
kevin-mizu
High
•$1500•CVE-2023-3975
SSRF through insecure PlantUML configuration
zeyu2001
informative
High
Desktop APP RCE via saveDraft IPC
kevin-mizu
Critical
•$3000•CVE-2023-3974
Insecure Direct Object Reference (IDOR) Vulnerability & Cross-Site Scripting (XS...
ellord0xd
spam
Lack of Input Validation
ellord0xd
not applicable
Inadequate Error Handling
ellord0xd
not applicable
Directory Traversal
ellord0xd
not applicable
Cross-site Scripting in Preview function bypass CSP
nhienit2010
Medium
•$300
Cross-site Scripting and CSP Bypass in app.diagrams.net
nhienit2010
Medium
•$300•CVE-2023-3026
AWS credentials exposure
omareltf
None
XSS and XXE due to .svg file is imported from unclaimed s3 bucket inside <img sr...
gauravbhatia1211
informative
Critical
HTML/Link Injection
dev696
spam
"from Template URL" parameter is vulnerable to external service interaction (SSR...
earth2sky
spam
HTML injection leads to Open Redirect
cupc4k3
spam
Path manipulation
petasplit
spam
Open redirect
petasplit
spam
Privacy violation
petasplit
spam
Command injection
petasplit
spam
stored xss in diagrams element
osama-shift
spam
XSS and CSP bypass in app.diagrams.net
joaovitormaia
Medium
•$300•CVE-2022-3873
Uncontrolled recursion via redirecting the /proxy to call /embed2.js
haxatron
informative
High
app.diagrams.net allows redirection to arbitrary URLs
mqsecx2
not applicable
Denial of Service in proxy by redirecting to own host
myyxl
High
•$900
Cross-site request forgery (CSRF)
mike993
duplicate
Medium
XSS via Mathematical Typesetting
kevin-mizu
Medium
•$300•CVE-2022-3223
Out-of-band resource load (HTTP) in /proxy endpoint
anhdq201
spam
SSRF via SVG
mohamedabdelhady933
spam
XSS at app.diagrams.net
joaovitormaia
Medium
•$300•CVE-2022-3148
unpatched vulnerability
maakthon
duplicate
None
XSS at https://viewer.diagrams.net/
joaovitormaia
Medium
•$360•CVE-2022-3138
XSS with CSP bypass on WEB instances
kevin-mizu
Medium
•$300•CVE-2022-3127
Desktop APP XSS to RCE
kevin-mizu
High
•$900•CVE-2022-3133
Access of Remote Resource without Timeout
maakthon
spam
drawio are vulnerable to a remote authenticated attacker due to Node.js CVE-2022...
imhunterand
spam
No rate limit via proxy url parameter
maakthon
Medium
•$300•CVE-2022-3065
d3-color Regular Expression Denial of Service (ReDoS)
mac-lawson
spam
ReDoS in isLink Regex
sim4n6
spam
Tabnabbing via window.opener [www.diagrams.net]
agnihackers
spam
Improper Input Validation leads to malicious CSV file download
kevin-mizu
not applicable
Client-side denial of service via CSV import
vovikhangcdv
informative
None
Default 404 Page Leads to Full Path Disclosure
whokilleddb
informative
None
Forward credential header to attacker host
am0o0
Medium
•$300
Client-Side RCE and Stored XSS via Unsafe Deserialization of Diagrams
7085
Critical
•$2000•CVE-2022-2014
Stored XSS via Deserialization of Stylesheets
7085
Medium
•$300•CVE-2022-2015
The drawio app allows large characters to insert in the input field "Edit Data"...
akshayravic09yc47
not applicable
proxying Big files leads to potential DOS [/proxy]
am0o0
Medium
•$300
proxying Big files leads to potential DOS
am0o0
Medium
•$300•CVE-2023-3398
Insufficient restriction of rendered UI layers or frames leading to clickjacking...
deleterepo
informative
Medium
SSRF in /service endpoint
am0o0
Medium
•$300•CVE-2022-1815
Denial of Service on embed2 servlet
joaovitormaia
High
•$900
Arbitrary Code Execution - Add External Plugins
ninj4c0d3r
informative
High
SSRF in Upload URL Parameter
vishalvishw10
informative
None
Exif Data Exposure
gaurav-g2
informative
None
Private IP addresses disclosed
nilabhrajpoot
not applicable
SSRF in embed2 servlet via redirects
haxatron
High
•$900•CVE-2022-1784
Bypass SSRF protection with 307 redirection
am0o0
duplicate
Critical
Full read Server Side Request Forgery via Dns rebinding attack
daman-preet-singh
not applicable
Regex check failed leads to CORS bypass
nhiephon
Low
Stored XSS on drawio
joaovitormaia
Medium
•$300•CVE-2022-1730
SSRF via IPv6 address 2
haxatron
None
Server Side Request Forgery via location header
myyxl
High
•$900•CVE-2022-1767
Path Traversal in WellKnownServlet
7085
High
•$900•CVE-2022-1721
Bypass /proxy SSRF protection
am0o0
self closed
Leakage of third-party OAuth token via redirect
caioluders
High
•$900•CVE-2022-1774
Arbitrary Local File Read and SSRF in EmbedServlet2
7085
duplicate
Critical
Server Side Request Forgery in drawio's 'checkUrlParameter' function
michaellrowley
informative
None
Local file inclusion
0x2374
High
•$900•CVE-2022-1723
SSRF in editor's proxy via IPv6 link-local address
haxatron
High
•$900•CVE-2022-1722
RCE in the Desktop App because of Unsafe Link Handling
7085
High
•$900•CVE-2022-1727
SSRF on /proxy
caioluders
High
•$2000•CVE-2022-1713
SSRF via Unvalidated Redirects in ProxyServlet
7085
High
•$900•CVE-2022-1711
Html Injection
gaurav-g2
Low
•$300
Arbitrary Code Execution through Sanitizer Bypass
7085
Critical
•$2000•CVE-2022-1575