Cross-site Scripting (XSS) - Reflected in jgraph/drawio

CVE-2023-3973

What is CVE-2023-3973?

A reflected Cross-site Scripting (XSS) vulnerability exists in Drawio versions prior to 21.6.3, allowing malicious actors to inject and execute arbitrary scripts in the context of a user's browser session. This exploitation could lead to unauthorized actions or data exposure for users interacting with the affected application, putting their sensitive information at risk.

References