drawio-desktop vulnerabilities

CVEs whose affected-version data names the drawio-desktop package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-114606Medium· 5.6

yesterday

draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpF…

▾ Sunlitjgraph · drawio-desktopvia CVEORG