J
JGraph
Security Risk Profile
47
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 6 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from February 24, 2018 to present
6
Total CVEs
2
Critical+High
0
Exploited
1
Unpatched
Threat Assessment
Avg CVSS
7
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
1
Critical/High
Risk Level
47/100
medium
📈 2 in Last 30 Days
Severity Distribution
Critical
1High
1Medium
4Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
0Age Distribution
Common Weaknesses (CWE)
1
XSS
3
2
SSRF
1
3
Input Validation
1
4
XEE
1
Most Affected Products
1. npm/mxgraph3
2. jgraph mxGraph3
3. jgraph draw.io2
4. ubuntu/libjgraphx-java2
5. jgraph draw.io Desktop1
Recent Vulnerabilities
See more →GHSA-xc39-mcq4-fr4q
CVSS 5.8medium
draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts
Nov 4, 2026🔧 No Patch
GHSA-qg46-52fx-h7p8
CVSS 7.8high
draw.io Desktop allows Windows executable search-path hijacking
Oct 30, 2026🔧 No Patch
CVE-2026-46642
CVSS 6.1medium
draw.io: XSS via crafted cell label when opening a .drawio file
Jun 10, 2026🔧 No Patch
CVE-2022-40440
CVSS 6.1medium
Oct 11, 2022🔧 No Patch
CVE-2019-13127
CVSS 6.1medium
Jul 1, 2019
CVE-2017-18197
CVSS 9.8critical
Feb 24, 2018
Monitor JGraph in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.