{"id":"CVE-2026-119333","kind":"vulnerability","aliases":["CVE-2026-119333"],"related":[],"title":"draw.io Desktop on Windows: planted executable runs when opening a diagram","description":"draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.","summary":"draw.io Desktop for Windows launches powershell and attrib by bare name, so a file placed next to a diagram can be run instead of the system tool. An attacker who gets a victim to extract an archive and open a .drawio file can run code as that user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["draw.io","electron","package","windows"],"not_affected_if":["already-updated","non-windows","web-version"],"how_to_check":"- Check the installed draw.io Desktop version in Help > About, or the app's package metadata; versions below `31.5.2` are affected.\n- Confirm the app runs on Windows; the description covers only the Windows build.","fix":"- draw.io Desktop: move to `31.5.2` or later.","status":"open","published_at":"2026-10-30T20:17:07+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","triaged_at":"2026-10-30T20:26:31+00:00","updated_at":"2026-10-30T20:26:31+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T20:26:31Z","model":"claude-haiku-5-5","output":{"fix":"- draw.io Desktop: move to `31.5.2` or later.","reach":"local","title":"draw.io Desktop on Windows: planted executable runs when opening a diagram","impact":"high","summary":"draw.io Desktop for Windows launches powershell and attrib by bare name, so a file placed next to a diagram can be run instead of the system tool. An attacker who gets a victim to extract an archive and open a .drawio file can run code as that user.","audience":"everyone","category":"package","nicknames":[],"who_cares":["draw.io","windows","electron"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker code runs as the logged-in Windows user","analyst_note":"","how_to_check":"- Check the installed draw.io Desktop version in Help > About, or the app's package metadata; versions below `31.5.2` are affected.\n- Confirm the app runs on Windows; the description covers only the Windows build.","plain_action":"Update draw.io Desktop to version 31.5.2 or later on Windows.","needs_analyst":false,"not_affected_if":["web-version","non-windows","already-updated"],"who_is_affected":"Windows users of draw.io Desktop before 31.5.2 who open diagrams from downloaded or extracted archives, especially when Local Fonts is enabled or draft/backup attributes are updated. Web-based draw.io and other platforms are not described as affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000688,"input_tokens":4236,"output_tokens":528,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119333':14A,17A '-2026':13A,16A '31.5.2':81C,176C 'allow':116C 'alreadi':100C 'applic':84C 'archiv':58B,141C 'attack':50B,120C,139C,154C 'attacker-control':119C,153C 'attacker-suppli':138C 'attrib':29B,88C 'attrib.exe':124C 'attribut':167C 'backup':166C 'bare':31B,90C 'build':76C 'code':66B,156C 'cold':144C 'cold-open':143C 'coloc':118C 'control':121C,155C 'could':150C 'current':113C 'cve':12A,15A 'desktop':2A,23B,71C,97C 'diagram':11A,40B,104C,110C 'directori':111C,115C 'draft':164C 'draw.io':1A,18B,22B,70C,78C,96C 'drawio':62B,148C 'electron':19B,75C 'enabl':161C 'execut':6A,91C,132C,152C 'explor':107C 'extract':56B,136C 'file':35B,63B,106C,149C 'fix':173C 'font':159C 'get':52B 'instead':44B 'intend':130C 'issu':171C 'launch':26B,85C 'legitim':147C 'local':158C 'made':108C 'name':32B,92C 'next':37B 'offici':74C 'open':9A,60B,102C,145C 'packag':20B 'place':36B 'plant':5A 'powershel':27B,86C 'powershell.bat':122C 'prior':79C 'resolv':127C 'run':7A,43B,65B,101C 'src/main/electron.js':94C 'suppli':140C 'system':47B,131C 'therefor':151C 'tool':48B 'updat':169C 'user':69B 'version':175C 'victim':54B,134C 'window':4A,21B,25B,83C 'work':114C","nicknames":[],"mitigations":[],"who_affected":"Windows users of draw.io Desktop before 31.5.2 who open diagrams from downloaded or extracted archives, especially when Local Fonts is enabled or draft/backup attributes are updated. Web-based draw.io and other platforms are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update draw.io Desktop to version 31.5.2 or later on Windows.","first_public_at":"2026-10-30T20:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119333","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119333","severity":null,"published_at":"2026-10-30T20:17:07+00:00","modified_at":"2026-10-30T20:17:07+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","fetched_at":"2026-10-30T20:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}