Live › vulnerability › CVE-2026-119333
draw.io Desktop for Windows launches powershell and attrib by bare name, so a file placed next to a diagram can be run instead of the system tool. An attacker who gets a victim to extract an archive and open a .drawio file can run code as that user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Windows users of draw.io Desktop before 31.5.2 who open diagrams from downloaded or extracted archives, especially when Local Fonts is enabled or draft/backup attributes are updated. Web-based draw.io and other platforms are not described as affected.
No product ranges from the sources yet.
31.5.2 are affected.31.5.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-119333")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.