Vulnerability Description
draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/jgraph/drawio-desktop/commit/3fed7ecfa6871d952d9946508ec85739
- https://github.com/jgraph/drawio-desktop/releases/tag/v31.5.2
- https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-qg46-52fx-h7p8
FAQ
What is CVE-2026-119333?
CVE-2026-119333 is a vulnerability with a CVSS score of 7.8 (HIGH). draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Deskt...
How severe is CVE-2026-119333?
CVE-2026-119333 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119333?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.