AEGLIX vulnerability intelligence
CVE-2026-46642
MEDIUM · CVSS 6.1 · Analyzed
Published: 2026-06-10 · Updated: 2026-10-26 · Source: NVD
Stored catalog record
Source record retrieved 2026-10-28T10:25:27.716833+00:00. Scheduled imports handle updates; this page does not assert that the provider was queried just now.
Vulnerability overview
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer (which works correctly on the rendering path) but in a feature-detection routine in the Text Format panel that reads the raw cell label and assigns it to a detached element's innerHTML without sanitization. Browsers fire onerror for failed image loads even on detached elements, so an <img src=x onerror=...> payload in any cell label triggers script execution as soon as the cell is selected — which import does automatically. This issue has been patched in version 29.7.12.
Patch review priority
Assess exposure and vendor guidance
- No higher-priority signal is available in the current stored evidence.
FIRST EPSS: 0.22% · percentile 12.6 · score date 2026-10-27.
EPSS estimates probability of exploitation in the next 30 days. It does not measure your exposure or prove exploitation. The elevated threshold is 10%; CISA KEV takes precedence. About FIRST EPSS ↗
Severity and scoring
- CVSS score
- 6.1 · MEDIUM
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Not listed in the CISA catalog retrieved for this record. This does not establish that exploitation has not occurred.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:a:diagrams:drawio:*:*:*:*:*:*:*:*
Before (exclusive): 29.7.12
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- https://github.com/jgraph/drawio/releases/tag/v29.7.12
Release Notes
- https://github.com/jgraph/drawio/security/advisories/GHSA-fqhg-287p-c6vf
Exploit · Mitigation · Vendor Advisory
- https://github.com/jgraph/drawio/security/advisories/GHSA-fqhg-287p-c6vf
Exploit · Mitigation · Vendor Advisory