Prototype Pollution Vulnerability in draw.io by JGraph
CVE-2026-115762

6.1MEDIUM

Key Information:

Vendor

Jgraph

Status
Drawio
Vendor
CVE Published:
4 November 2026

What is CVE-2026-115762?

The draw.io application prior to version 31.1.5 is susceptible to a prototype pollution vulnerability within its GraphML decoder. This flaw allows an attacker to leverage GraphML reference keys to manipulate inherited object properties, including prototype objects. By importing a specially crafted GraphML file, an adversary can execute harmful scripts via client-side prototype pollution. This becomes particularly concerning when the editor is used in Trello mode, as the integration process can trigger the execution of the polluted state within the draw.io environment, thereby compromising the integrity of user data and the application. The issue has been rectified in version 31.1.5, emphasizing the importance of updating to mitigate such security risks.

Affected Version(s)

drawio < 31.1.5

References

https://github.com/jgraph/drawio/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/jgraph/drawio/commit/3b4210678207f3880...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.