CVE-2026-58504: draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.addFont() in src/main/webapp/js/grapheditor/Format.js. An HTML sibling cell keeps the formatted-label path enabled while an editable=0 plain-text sibling is excluded from the merged selection style but remains in the iteration set. graph.cellRenderer.getLabelValue() returns that plain-text label without HTML encoding, and mxUtils.canConvertHtmlToSvg() parses it as HTML, bypassing the earlier CVE-2026-46642 remediation. Successful exploitation can expose diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim. This issue is fixed in version 30.2.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
draw.ioto a version that resolves this vulnerability.Fixed in 30.2.5 - Compensating control
Until updated, avoid opening or importing untrusted .drawio files (especially crafted files that trigger TextFormatPanel.addFont() processing of selected cells) to prevent stored XSS on file open.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of draw.io versions before 30.2.5 are exposed when they open or import a crafted .drawio file. Exploitation runs in the draw.io origin and requires the victim to interact with the malicious file.
What does an attacker need to exploit it?
An attacker needs to create a crafted .drawio file containing selected sibling cells arranged to reach the formatted-label processing path. No authentication or elevated privileges are required, but a victim must open or import the file.
What could successful exploitation expose?
Attacker-controlled JavaScript can access diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim. Availability impact is not indicated.
What should teams do to remediate it?
Update draw.io to version 30.2.5, which fixes this patch bypass. Until updated, avoid opening or importing untrusted .drawio files.