CVE-2026-97373

draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.

• CWE-918

• https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d
• https://github.com/jgraph/drawio/security/advisories/GHSA-xc39-mcq4-fr4q

Published

Nov 4, 2026

Last Modified

Nov 4, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97365A vulnerability was determined in chonkie-inc littrs 0.6.1/0…6.3
• CVE-2026-97366A security flaw has been discovered in jhen0409 react-native…6.3
• CVE-2026-97368A weakness has been identified in chillzhuang SpringBlade up…6.3
• CVE-2026-9737During query planning when reading the sort pattern in raw B…6.5
• CVE-2026-97370Junrar is an open source Java RAR archive library. Prior to …7.5
• CVE-2026-97371ntopng is a web-based network traffic monitoring application…5.3
• CVE-2026-97377SuiteCRM is an open-source, enterprise-ready Customer Relati…8.8
• CVE-2026-9738The Print, PDF, Email by PrintFriendly plugin for WordPress …4.4
• CVE-2026-97380MariaDB server is a community developed fork of MySQL server…8.8
• CVE-2026-97381Legacy Update is a tool for activating and installing update…9.9
• CVE-2026-97387Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-9739Vulnerable to DNS rebinding attacks when using SSE (http://b…9.4