CVE-2026-42195

{
  "id": "CVE-2026-42195",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-08T22:16:31.410",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's \"Authorize in GitLab\" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9."
    },
    {
      "lang": "es",
      "value": "draw.io es una aplicación configurable de diagramación y pizarra blanca. Antes de la versión 29.7.9, el cliente de draw.io acepta un parámetro URL ?gitlab= que anula la URL del servidor de GitLab utilizada durante el inicio de sesión OAuth. Un enlace manipulado hace que el clic del usuario en el diálogo ’Autorizar en GitLab’ de draw.io abra una ventana emergente en el host controlado por el atacante en lugar de gitlab.com. Esto puede conducir a phishing de credenciales y a la exfiltración de tokens de estado de sesión. Este problema ha sido parcheado en la versión 29.7.9."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "jgraph",
          "product": "drawio",
          "versions": [
            {
              "version": "< 29.7.9",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
          "baseScore": 3.4,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T17:18:43.655474Z",
          "id": "CVE-2026-42195",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/jgraph/drawio/issues/493",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/jgraph/drawio/releases/tag/v29.7.9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x",
      "source": "[email protected]"
    }
  ]
}