PT-2026-39197 · Drawio · Drawio

Fl3X1Nz · Published 2026-05-08 · Updated 2026-05-09 · CVE-2026-42195

Positive Technologies (AI Summary)

CVSS v3.1

3.4

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 29.7.9

Description The application accepts a gitlab URL parameter that overrides the GitLab server URL used during OAuth sign-in. An attacker can use a crafted link to cause the "Authorize in GitLab" dialog to open a popup on a host under their control instead of the legitimate gitlab.com. This behavior can lead to credential fishing and the exfiltration of session state tokens.

Recommendations Update to version 29.7.9.

Fix

Information Disclosure

Open Redirect

Weakness Enumeration

CWE-200

CWE-601

Related Identifiers

CVE-2026-42195

Affected Products

Drawio

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-42195 · Security Note
• https://github.com/jgraph/drawio/issues/493 · Note
• https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x · Note
• https://github.com/jgraph/drawio/releases/tag/v29.7.9 · Note
• https://twitter.com/CVEnew/status/2053131438581809418 · Twitter Post