CVE-2026-76898

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-76898
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76898.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-76898
Aliases
  • GHSA-m3q9-cwfq-hcjc
Published
2026-09-21T16:31:54Z
Modified
2026-09-23T08:13:02Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js
Details

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the fc00::/7 range, including the AWS metadata range fd00:ec2::/32, is not blocked. An unauthenticated request to /embed2.js?fetch= can therefore make src/main/java/com/mxgraph/online/EmbedServlet2.java fetch an IPv6 ULA internal resource and reflect the response to the requester. Utils.validatedAddress() uses the same private-address check for the separate ProxyServlet path, which requires ENABLE_DRAWIO_PROXY=1. The primary /embed2.js path requires no proxy feature flag or DNS rebinding, and it can disclose cloud metadata credentials or data from other IPv6-reachable internal services. This issue is fixed in version 30.3.8.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76898.json"
}
References

Affected packages

Git / github.com/jgraph/drawio

Affected ranges

Type
GIT
Repo
https://github.com/jgraph/drawio
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
73c4a91196246bbdb60f52b15871e82006b7972d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "30.3.8"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v24.*
v24.8.9
v25.*
v25.0.0
v25.0.1
v25.0.2
v26.*
v26.0.0
v26.0.13
v26.0.15
v26.0.16
v26.0.2
v26.0.3
v26.0.4
v26.0.6
v26.0.7
v26.0.9
v26.1.0
v26.1.1
v26.2.15
v26.2.2
v26.2.7
v26.2.8
v27.*
v27.0.2
v27.0.5
v27.0.9
v27.1.6
v28.*
v28.0.1
v28.0.3
v28.0.4
v28.0.5
v28.0.6
v28.0.7
v28.0.9
v28.1.1
v28.1.2
v28.2.0
v28.2.3
v28.2.5
v28.2.7
v28.2.8
v28.2.9
v29.*
v29.0.2
v29.0.3
v29.2.2
v29.2.6
v29.2.7
v29.2.9
v29.3.0
v29.3.2
v29.3.5
v29.3.6
v29.5.1
v29.5.2
v29.6.1
v29.6.10
v29.6.3
v29.6.4
v29.6.5
v29.6.6
v29.6.7
v29.7.11
v29.7.12
v29.7.8
v29.7.9
v30.*
v30.0.0
v30.0.1
v30.0.2
v30.0.4
v30.2.4
v30.2.5
v30.2.6
v30.2.7
v30.3.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76898.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "168246928896176687700394690963952432596",
            "length":  1794
        },
        "id":  "CVE-2026-76898-05bb3504",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d",
        "target":  {
            "file":  "src/main/java/com/mxgraph/online/Utils.java",
            "function":  "validatedAddress"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "196325269415832384282799394620574459086",
                "163951429916879927423065970490515472590",
                "113919253871639426799014872809821322866",
                "105925264544723543550342638766070104327",
                "80869527727110091106827097688943973015",
                "318502984369116557864197278265571741709",
                "182902339622830740980827218983173218335",
                "139899721050825447637327154491022461643",
                "62688104822552041593747328114964531183",
                "194320623952635297537975950581797134414",
                "320957940687665119383156445706418062720",
                "230243175846188846670429712890594456685"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-76898-079264dc",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d",
        "target":  {
            "file":  "src/main/java/com/mxgraph/online/EmbedServlet2.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "76892277951041343052526481198232074047",
            "length":  3338
        },
        "id":  "CVE-2026-76898-3138a777",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d",
        "target":  {
            "file":  "src/main/java/com/mxgraph/online/EmbedServlet2.java",
            "function":  "createEmbedJavaScript"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "317159762213973568379739420242861351150",
                "163156020614683463749051496377308641141",
                "201859201929844662248650151542280331682",
                "319326840680541766670581635304266218024",
                "261471031652321805131528342950500963442",
                "324193896816250659448494810209056500884",
                "173217358210780132729450888300889661900",
                "299096821301481517367944081178397250390",
                "259803583123181893001979313600129983331",
                "243043794115762115575459963662774122200",
                "275632844486393660391649638234694583524",
                "296643550155431026231932203434166245031"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-76898-616b1ecf",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d",
        "target":  {
            "file":  "src/main/java/com/mxgraph/online/Utils.java"
        }
    }
]
vanir_signatures_modified 
"2026-09-23T08:13:02Z"