CVE-2026-119333

Full vulnerability record from the local CVENow database.

Description

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.

Severity

HIGH

CVSS score

7.8 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-10-30 20:17:07.780000

Last modified

2026-10-30 20:17:07.780000

View original CVE JSON

{
  "id": "CVE-2026-119333",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-30T20:17:07.780",
  "lastModified": "2026-10-30T20:17:07.780",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "jgraph",
          "product": "drawio-desktop",
          "versions": [
            {
              "version": "< 31.5.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/jgraph/drawio-desktop/commit/3fed7ecfa6871d952d9946508ec85739796a59b2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/jgraph/drawio-desktop/releases/tag/v31.5.2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-qg46-52fx-h7p8",
      "source": "[email protected]"
    }
  ]
}