CVE-2022-1575: Diagrams Drawio

Critical severity, CVSS 9.6. EPSS: 2.4% chance of exploitation in the next 30 days.

Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the web app.

Affected products

• Diagrams Drawio: before 18.0.0 (fixed in 18.0.0)

Published 2022-05-05. Last modified 2026-06-17.