CVE-2026-46642

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer (which works correctly on the rendering path) but in a feature-detection routine in the Text Format panel that reads the raw cell label and assigns it to a detached element's innerHTML without sanitization. Browsers fire onerror for failed image loads even on detached elements, so an <img src=x onerror=...> payload in any cell label triggers script execution as soon as the cell is selected — which import does automatically. This issue has been patched in version 29.7.12.

• CWE-79

• https://github.com/jgraph/drawio/releases/tag/v29.7.12Release Notes
• https://github.com/jgraph/drawio/security/advisories/GHSA-fqhg-287p-c6vfExploit, Mitigation, Vendor Advisory
• https://github.com/jgraph/drawio/security/advisories/GHSA-fqhg-287p-c6vfExploit, Mitigation, Vendor Advisory

Published

Jun 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46635Twig is a template language for PHP. Prior to 3.26.0, the co…4.3
• CVE-2026-46637Twig is a template language for PHP. Prior to 3.26.0, severa…5.4
• CVE-2026-46638Twig is a template language for PHP. Prior to 3.26.0, {% san…8.1
• CVE-2026-46639Twig is a template language for PHP. From 3.24.0 until 3.26.…6.5
• CVE-2026-4664The Customer Reviews for WooCommerce plugin for WordPress is…5.3
• CVE-2026-46640Twig is a template language for PHP. From 3.15.0 until 3.26.…8.8
• CVE-2026-46643Snappy is a PHP library allowing thumbnail, snapshot or PDF …7.5
• CVE-2026-46644Symfony Polyfill backports PHP features and provides compati…6.9
• CVE-2026-46645SQLAdmin is a flexible Admin interface for SQLAlchemy models…4.3
• CVE-2026-4665The WP Carousel Free plugin for WordPress is vulnerable to S…6.4
• CVE-2026-46654Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to v…8.9
• CVE-2026-46656Bludit is a content management system. Versions prior to 3.2…8.8