OS Command Injection in jgraph/drawio

CVE-2023-3974

What is CVE-2023-3974?

The jgraph/drawio project is susceptible to an OS command injection vulnerability, allowing attackers to execute arbitrary commands on the host operating system. This vulnerability affects all versions prior to 21.4.0, posing significant security risks for users who rely on this tool for diagramming and collaboration. Attackers can exploit this flaw to gain unauthorized access and manipulate system commands, potentially leading to data breaches and further exploits. It is crucial to upgrade to the latest version to mitigate these risks effectively.

References