OS Command Injection in jgraph/drawio

CVE-2023-3975

What is CVE-2023-3975?

An OS Command Injection vulnerability affects JGraph's Draw.io product, specifically in versions prior to 21.5.0. This security issue allows an attacker to execute arbitrary commands on the server. The flaw arises from improper handling of user input, which can be manipulated to include malicious commands. Users are encouraged to update to the latest version to mitigate this risk. Details and fixes for this vulnerability can be found in the official GitHub repository.

References