draw.io Desktop: Executable search-path hijacking on Windows
Summary
draw.io Desktop for Windows starts the system programs powershell and attrib by bare name. If draw.io was not running and a user opens a diagram from File Explorer, the diagram's folder becomes the working directory, so an attacker-supplied powershell.bat or attrib.exe in that folder can run instead. An attacker can execute code with the privileges of the user, provided the victim extracts a malicious archive and opens the included .drawio file, and Local Fonts are enabled or draft or backup attributes are updated.
Affected
- draw.io Desktop (jgraph/drawio-desktop) on Windows, versions before 31.5.2
Fixed in
- Fixed in version 31.5.2, which starts Windows system programs by their full path.
Workaround
- Unknown. The vendor advisory mentions no other mitigation.
- Until the update is installed, do not open .drawio files from unknown archives or downloads.
Exploitation
- No public exploit code or known exploitation as of the latest information available (CISA KEV: not listed).
- Attack vector is local, no privileges required, user interaction required (CVSS 7.8).
Our recommendation
- Update draw.io Desktop on Windows to 31.5.2 or a later release.
- Check which Windows workstations have draw.io Desktop installed and prioritise those where users open files from email or downloads.
- Instruct users not to open diagrams from unknown archives until the update is installed.
- Monitor for unexpected powershell or attrib processes started from draw.io.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 3fed7ec github.com
- draw.io Desktop release 31.5.2 github.com
- GitHub Security Advisory GHSA-qg46-52fx-h7p8 github.com
- OffSeq Radar CVE-2026-119333 radar.offseq.com
- VulDB CVE-2026-119333 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:40.
Original description (NVD)
draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.