https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 23:26:22 +0000 https://cve.radiocsirt.org/vuln/cve-2026-46642 <p><strong>Affected:</strong> jgraph drawio</p> <p>draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor&#39;s origin when the file is opened. The vulnerability is not in the label sanitizer (which works correctly on the rendering path) but in a feature-detection routine in the Text Format panel that reads the raw cell label and assigns it to a detached element&#39;s innerHTML without sanitization. Browsers fire onerror for failed image loads even on detached elements, so an &lt;img src=x onerror=...&gt; payload in any cell label triggers script execution as soon as the cell is selected — which import does automatically. This issue has been patched in version 29.7.12.</p> <p><strong>Affected:</strong> jgraph drawio</p> <p>draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor&#39;s origin when the file is opened. The vulnerability is not in the label sanitizer (which works correctly on the rendering path) but in a feature-detection routine in the Text Format panel that reads the raw cell label and assigns it to a detached element&#39;s innerHTML without sanitization. Browsers fire onerror for failed image loads even on detached elements, so an &lt;img src=x onerror=...&gt; payload in any cell label triggers script execution as soon as the cell is selected — which import does automatically. This issue has been patched in version 29.7.12.</p> https://cve.radiocsirt.org/vuln/cve-2026-46642