CVE-2026-46642: draw.io XSS Vulnerability

CVE-2026-46642 Overview

CVE-2026-46642 is a cross-site scripting (XSS) vulnerability in draw.io, a configurable diagramming and whiteboarding application. Versions prior to 29.7.12 allow a crafted .drawio file to execute arbitrary JavaScript in the editor's origin when opened. The flaw resides in a feature-detection routine in the Text Format panel that assigns raw cell label content to a detached element's innerHTML without sanitization. The label sanitizer on the rendering path is unaffected. This issue is tracked as [CWE-79] and is patched in version 29.7.12.

Critical Impact
An attacker who convinces a user to open a malicious .drawio file can run arbitrary JavaScript in the editor's origin, enabling theft of session data and actions on behalf of the victim.

Affected Products

draw.io versions prior to 29.7.12
draw.io desktop and web editor builds that include the Text Format panel feature-detection routine
Embedded draw.io integrations that import .drawio files automatically

Discovery Timeline

2026-06-10 - CVE-2026-46642 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46642

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw triggered when draw.io processes a crafted diagram file. When a cell is selected, the Text Format panel runs a feature-detection routine that reads the raw cell label and writes it to a detached DOM element using innerHTML. Because the label is never passed through the sanitizer used on the rendering path, attacker-controlled markup is parsed as HTML.

Browsers fire the onerror handler for failed image loads even on detached elements. An <img src=x onerror=...> payload embedded in any cell label therefore executes JavaScript as soon as the cell is selected. Importing a .drawio file selects cells automatically, so no further user interaction is required after the file is opened.

The executing script runs in the editor's origin, giving it access to local storage, session cookies scoped to that origin, and any APIs the editor exposes. In embedded deployments, this can extend to parent application data depending on the embedding context.

Root Cause

The root cause is inconsistent sanitization between code paths. The rendering pipeline sanitizes labels correctly, but the Text Format panel's feature-detection routine bypasses sanitization by assigning the raw label string to innerHTML on a detached element. Detached elements still trigger image loading and onerror callbacks, so the assumption that detachment prevents script execution is incorrect.

Attack Vector

An attacker crafts a .drawio file containing a cell whose label includes an HTML payload such as an <img> tag with an onerror attribute. The attacker delivers the file by email, shared drive, or web download. When the victim opens the file in a vulnerable draw.io editor, the import routine selects cells, the Text Format panel runs feature detection, and the payload executes in the editor's origin.

No authentication is required on the attacker side, and the payload runs with the privileges of the user opening the file. See the GitHub Security Advisory GHSA-fqhg-287p-c6vf for additional technical detail.

Detection Methods for CVE-2026-46642

Indicators of Compromise

.drawio, .xml, or .drawio.svg files containing <img tags with onerror attributes inside cell value or label fields
Diagram files containing inline <script> tags or javascript: URIs within cell labels
Unexpected outbound network requests from the draw.io editor origin shortly after a file import

Detection Strategies

Scan diagram files at rest and in transit for HTML event handler attributes such as onerror, onload, and onclick inside label or value attributes
Monitor browser telemetry for script execution originating from the draw.io editor origin immediately after file import events
Inspect content security policy violation reports from the editor origin for blocked inline script or image-load events

Monitoring Recommendations

Log file uploads and imports of .drawio content in collaboration platforms and SaaS file shares
Alert on draw.io editor sessions making outbound requests to non-allowlisted domains
Track draw.io version inventory across desktop installations and self-hosted deployments to identify pre-29.7.12 instances

How to Mitigate CVE-2026-46642

Immediate Actions Required

Upgrade all draw.io installations to version 29.7.12 or later
Audit recent .drawio file imports from untrusted sources and revoke any session tokens that may have been exposed
Block or quarantine .drawio files from external senders until patching is complete

Patch Information

The vendor released a fix in draw.io 29.7.12. Details are available in the GitHub Draw.io Release v29.7.12 notes and the GitHub Security Advisory GHSA-fqhg-287p-c6vf. The patch routes the Text Format panel feature-detection path through the existing label sanitizer.

Workarounds

Do not open .drawio files received from untrusted or unverified sources until the editor is patched
Apply a strict Content Security Policy on self-hosted editor origins to block inline event handlers and unexpected network destinations
Isolate the draw.io editor origin from sensitive application origins to limit the blast radius of script execution

bash

# Verify the running draw.io version against the patched release
grep -R "version" ./drawio/package.json
# Expected: "version": "29.7.12" or later