CVE-2026-58504 is a medium-severity vulnerability in draw.io, a configurable diagramming and whiteboarding application. The issue allows for the execution of attacker-controlled JavaScript when a crafted .drawio file is opened or imported. This can lead to the exposure of diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim. The vulnerability is fixed in version 30.2.5.
CVE-2026-46642 is a vulnerability in draw.io, a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer (which works correctly on the rendering path) but in a feature-detection routine in the Text Format panel that reads the raw c [truncated]
