CVE-2026-58504

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-58504

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58504.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-58504

Aliases

GHSA-c76x-r78m-phwx

Published

2026-09-21T16:15:30Z

Modified

2026-10-28T02:30:49Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642

Details

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.addFont() in src/main/webapp/js/grapheditor/Format.js. An HTML sibling cell keeps the formatted-label path enabled while an editable=0 plain-text sibling is excluded from the merged selection style but remains in the iteration set. graph.cellRenderer.getLabelValue() returns that plain-text label without HTML encoding, and mxUtils.canConvertHtmlToSvg() parses it as HTML, bypassing the earlier CVE-2026-46642 remediation. Successful exploitation can expose diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim. This issue is fixed in version 30.2.5.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-116",
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58504.json"
}

References

Affected packages

Git / github.com/jgraph/drawio

Affected ranges

Type

GIT

Repo

https://github.com/jgraph/drawio

Events

Introduced

Fixed

7976c02e1b10b1687c028d82782f9f5d90a885d6

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "30.2.5"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "7976c02e1b10b1687c028d82782f9f5d90a885d6"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v30.2.5",
            "range": [
                {
                    "fixed": "7976c02e1b10b1687c028d82782f9f5d90a885d6"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "30.2.5"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

v24.*

v24.8.9

v25.*

v25.0.0

v25.0.1

v25.0.2

v26.*

v26.0.0

v26.0.13

v26.0.15

v26.0.16

v26.0.2

v26.0.3

v26.0.4

v26.0.6

v26.0.7

v26.0.9

v26.1.0

v26.1.1

v26.2.15

v26.2.2

v26.2.7

v26.2.8

v27.*

v27.0.2

v27.0.5

v27.0.9

v27.1.6

v28.*

v28.0.1

v28.0.3

v28.0.4

v28.0.5

v28.0.6

v28.0.7

v28.0.9

v28.1.1

v28.1.2

v28.2.0

v28.2.3

v28.2.5

v28.2.7

v28.2.8

v28.2.9

v29.*

v29.0.2

v29.0.3

v29.2.2

v29.2.6

v29.2.7

v29.2.9

v29.3.0

v29.3.2

v29.3.5

v29.3.6

v29.5.1

v29.5.2

v29.6.1

v29.6.10

v29.6.3

v29.6.4

v29.6.5

v29.6.6

v29.6.7

v29.7.11

v29.7.12

v29.7.8

v29.7.9

v30.*

v30.0.0

v30.0.1

v30.0.2

v30.0.4

v30.2.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58504.json"