PT-2025-37726 · Drawnix · Drawnix

H3Rrr · Published 2025-09-15 · Updated 2025-09-20 · CVE-2025-58172

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions drawnix versions through 0.2.1

Description drawnix is an all-in-one open-source whiteboard tool. A cross-site scripting (XSS) issue exists in the debug logging functionality. User-controlled content is inserted directly into the DOM via innerHTML without sanitization when the global function drawnix web console is invoked. Specifically, in apps/web/src/app/app.tsx, div.innerHTML = value is executed. This can allow arbitrary JavaScript execution in the context of the application if an attacker can cause untrusted data to be passed to the debug logger, potentially exposing user data or enabling unauthorized actions.

Recommendations Update to version 0.3.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-58172

GHSA-CQ57-Q8HG-XHXF

Affected Products

Drawnix

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58172.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-58172 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58172 · Vendor Advisory
• https://github.com/plait-board/drawnix/commit/92536e63c1adcc509ac51fdd439d4794c8081c58 · Note
• https://github.com/plait-board/drawnix/security/advisories/GHSA-cq57-q8hg-xhxf · Note
• https://twitter.com/VulmonFeeds/status/1967789070513295726 · Twitter Post
• https://twitter.com/CVEnew/status/1969292020817576136 · Twitter Post