CVE-2026-119333

    Dashboard / Vulnerabilities / CVE-2026-119333

    CVE-2026-119333

    Published: 30 Oct 2026Last Modified: 4 Nov 2026

    Summary: draw.io Desktop allows Windows executable search-path hijacking

    Details: draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.

    References: https://github.com/jgraph/drawio-desktop/releases/tag/v31.5.2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119333.json, https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-qg46-52fx-h7p8, https://nvd.nist.gov/vuln/detail/CVE-2026-119333, https://github.com/jgraph/drawio-desktop/commit/3fed7ecfa6871d952d9946508ec85739796a59b2

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -45b2befa1d57af65124f0c9a076c20e1e79ef981

    Affected versions

    v31.4.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119333 | CVE-DB