CVE-2026-58504: draw.io XSS Vulnerability

CVE-2026-58504 Overview

CVE-2026-58504 is a stored Cross-Site Scripting (XSS) vulnerability in draw.io, a configurable diagramming and whiteboarding application. Versions prior to 30.2.5 process crafted .drawio files in a way that executes attacker-controlled JavaScript in the draw.io origin. The flaw resides in TextFormatPanel.addFont() within src/main/webapp/js/grapheditor/Format.js. The issue bypasses the prior remediation for CVE-2026-46642, categorized as Improper Neutralization of Input During Web Page Generation [CWE-79]. Successful exploitation can expose diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim.

Critical Impact
Opening or importing a malicious .drawio file triggers script execution in the draw.io origin, enabling theft of session data and same-origin actions on behalf of the victim.

Affected Products

draw.io versions prior to 30.2.5
draw.io desktop and embedded deployments using the vulnerable grapheditor module
Applications shipping src/main/webapp/js/grapheditor/Format.js from affected releases

Discovery Timeline

2026-09-21 - CVE-2026-58504 published to NVD
2026-09-23 - Last updated in NVD database
30.2.5 release - Fix shipped in draw.io version 30.2.5

Technical Details for CVE-2026-58504

Vulnerability Analysis

The vulnerability triggers when draw.io processes selected cells through TextFormatPanel.addFont(). An attacker crafts a .drawio file containing two sibling cells within a merged selection. One sibling is an HTML cell that keeps the formatted-label code path enabled. The other sibling is a plain-text cell with editable=0, which the merged selection style excludes but the iteration loop still processes.

When the loop reaches the plain-text sibling, graph.cellRenderer.getLabelValue() returns the label without HTML encoding. mxUtils.canConvertHtmlToSvg() then parses that raw label as HTML. Any script constructs contained in the label execute inside the draw.io origin. This defeats the sanitization added for CVE-2026-46642, which assumed the excluded plain-text path would not reach an HTML parser.

Root Cause

The root cause is inconsistent handling of the editable=0 plain-text sibling between the style-merging logic and the iteration logic in TextFormatPanel.addFont(). The cell is treated as plain text for style purposes but its label is subsequently passed to an HTML parser without encoding, resulting in stored XSS [CWE-79].

Attack Vector

Exploitation requires the victim to open or import a crafted .drawio file. No authentication is needed on the draw.io origin, but user interaction is required. Once loaded, the payload runs with the privileges of the draw.io page, granting access to diagram content, localStorage, sessionStorage, non-HttpOnly cookies, and any same-origin API the victim can reach.

text

+19-JUN-2026: 30.2.5
+
+- fix(sidebar): pass title element to onInit in expanded addPalette path
+- feat(embed): optional mermaid group wrap on descriptor load
+- Fixes view jump on mouse wheel zoom [jgraph/drawio#5639]
+- Guard mxUtils.isVerticalTextDirection against non-string values
+- Fix desktop CLI Mermaid + ELK layout export
+- Fixes stored XSS on file open via editable=0
+
 18-JUN-2026: 30.2.4

Source: GitHub Commit 7976c02. The changelog entry "Fixes stored XSS on file open via editable=0" corresponds to the remediation for this issue.

Detection Methods for CVE-2026-58504

Indicators of Compromise

.drawio files containing cells with editable=0 alongside HTML-formatted sibling cells where the plain-text label includes <script>, onerror=, onload=, or other event-handler HTML.
Browser console errors or Content Security Policy (CSP) violations originating from the draw.io origin after a diagram is opened.
Unexpected outbound requests from user browsers immediately following the opening of an untrusted diagram file.

Detection Strategies

Scan file shares, mail gateways, and collaboration platforms for .drawio and .xml diagram files whose XML contains editable="0" combined with HTML tags in value attributes.
Deploy CSP headers with reporting to surface inline-script execution attempts inside the draw.io origin.
Inspect web proxy logs for anomalous cross-origin requests generated by browsers that have recently loaded diagram files from external sources.

Monitoring Recommendations

Monitor draw.io deployment version strings and alert on any instance below 30.2.5.
Log and review file uploads to diagramming portals and Confluence/Jira instances that render draw.io diagrams.
Enable browser telemetry that captures script-source violations in origins hosting draw.io.

How to Mitigate CVE-2026-58504

Immediate Actions Required

Upgrade all draw.io deployments to version 30.2.5 or later without delay.
Audit embedded and desktop installations, including Confluence and Jira add-ons, for bundled draw.io versions.
Block or quarantine .drawio files received from untrusted senders until the upgrade completes.

Patch Information

The fix is available in draw.io 30.2.5. Refer to the GitHub Release v30.2.5, the GitHub Security Advisory GHSA-c76x-r78m-phwx, and the remediation commit 7976c02 for full details.

Workarounds

Do not open .drawio files from untrusted sources until the patched version is installed.
Serve draw.io behind a strict Content Security Policy that disallows inline scripts and restricts connect-src to trusted endpoints.
Host draw.io on an isolated origin with no access to sensitive cookies or shared session state.

bash

# Verify installed draw.io version and upgrade
grep -R "30\.2\." /path/to/drawio/VERSION
# Upgrade via container image
docker pull jgraph/drawio:30.2.5
docker stop drawio && docker rm drawio
docker run -d --name drawio -p 8080:8080 jgraph/drawio:30.2.5