GHSA-qg46-52fx-h7p8: draw.io Desktop allows Windows executable search-path hijacking
draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
draw.io Desktopto a version that resolves this vulnerability.Fixed in 31.5.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Windows users of draw.io Desktop versions before 31.5.2 are exposed when they open a diagram from File Explorer while the application is not already running. The risk applies when the diagram directory contains an attacker-controlled powershell.bat or attrib.exe.
What user action is required for exploitation?
A victim must cold-open a legitimate .drawio file from an attacker-supplied directory, such as one extracted from an archive. The application must invoke the affected command path, which occurs when Local Fonts are enabled or when draft or backup attributes are updated.
Is simply opening a malicious diagram enough?
The described attack depends on a malicious executable or batch file being colocated with the diagram and the diagram being opened from File Explorer while draw.io Desktop is not already running. The advisory does not state that diagram content alone triggers code execution.
What should be done if patching cannot happen immediately?
Avoid cold-opening .drawio files from untrusted or attacker-supplied directories, especially extracted archives, and do not keep executable or batch files alongside diagrams. Opening draw.io Desktop before opening a diagram may avoid the stated cold-open condition, but this is not described as a complete mitigation.
How can I remediate the issue?
Update draw.io Desktop to version 31.5.2, which fixes the executable search-path hijacking issue.