Diagrams, through its widely deployed draw.io diagramming and visualization platform, occupies a prominent position in enterprise and collaborative software environments where users create, edit, and share technical and business diagrams. Its vulnerability profile skews toward serious outcomes, with a meaningful share reaching critical severity and a notable tendency toward public exploit availability, reflecting the product's dual exposure as both a web application and a server-side rendering system. The recurring weakness classes—including cross-site scripting, server-side request forgery, OS command injection, code injection, and sensitive information exposure—are characteristic of web platforms that handle user input, generate dynamic content, and interact with backend systems. Defenders should treat draw.io updates as relevant to their web and collaboration infrastructure and prioritize patches for internet-exposed instances; live severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Diagrams over time
Signals from CVEs in this vendor scope (27 CVEs).
27 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-1711HIGH Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5. | May 17, 2022 | 7.5 | 38 | NO | YES |
CVE-2022-1713HIGH SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive informat | May 16, 2022 | 7.5 | 34 | NO | YES |
CVE-2023-3975CRITICAL OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0. | Jul 27, 2023 | 9.8 | 30 | NO | NO |
CVE-2022-1815HIGH Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2. | May 25, 2022 | 7.5 | 30 | NO | YES |
CVE-2022-1575CRITICAL Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the we | May 5, 2022 | 9.6 | 29 | NO | NO |
CVE-2022-3133HIGH OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0. | Sep 9, 2022 | 7.8 | 26 | NO | NO |
CVE-2022-3065HIGH Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8. | Sep 2, 2022 | 7.5 | 25 | NO | NO |
CVE-2022-2015MEDIUM Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2. | Jun 9, 2022 | 5.4 | 25 | NO | NO |
CVE-2022-1767HIGH Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7. | May 18, 2022 | 7.5 | 25 | NO | NO |
CVE-2022-1721HIGH Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application. | May 16, 2022 | 7.5 | 25 | NO | NO |
Signals from CVEs in this vendor scope (27 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Diagrams.
Media articles that mention a CVE ID that affects a product developed by Diagrams — matched by CVE ID, not by vendor name.