CVE-2026-42195

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.

CVSS v3 3.4 LOW

3.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/jgraph/drawio/issues/493
https://github.com/jgraph/drawio/releases/tag/v29.7.9
https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x

Configurations

No configuration.

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) draw.io es una aplicación configurable de diagramación y pizarra blanca. Antes de la versión 29.7.9, el cliente de draw.io acepta un parámetro URL ?gitlab= que anula la URL del servidor de GitLab utilizada durante el inicio de sesión OAuth. Un enlace manipulado hace que el clic del usuario en el diálogo ’Autorizar en GitLab’ de draw.io abra una ventana emergente en el host controlado por el atacante en lugar de gitlab.com. Esto puede conducir a phishing de credenciales y a la exfiltración de tokens de estado de sesión. Este problema ha sido parcheado en la versión 29.7.9.

Information

Published : 2026-05-08 22:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-42195

Mitre link : CVE-2026-42195

CVE.ORG link : CVE-2026-42195

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2026-42195", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42195", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T17:18:43.655474Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.4, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "jgraph", "product": "drawio", "versions": [{"status": "affected", "version": "< 29.7.9"}]}]}], "published": "2026-05-08T22:16:31.410", "references": [{"url": "https://github.com/jgraph/drawio/issues/493", "source": "security-advisories@github.com"}, {"url": "https://github.com/jgraph/drawio/releases/tag/v29.7.9", "source": "security-advisories@github.com"}, {"url": "https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's \"Authorize in GitLab\" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9."}, {"lang": "es", "value": "draw.io es una aplicaci\u00f3n configurable de diagramaci\u00f3n y pizarra blanca. Antes de la versi\u00f3n 29.7.9, el cliente de draw.io acepta un par\u00e1metro URL ?gitlab= que anula la URL del servidor de GitLab utilizada durante el inicio de sesi\u00f3n OAuth. Un enlace manipulado hace que el clic del usuario en el di\u00e1logo \u2019Autorizar en GitLab\u2019 de draw.io abra una ventana emergente en el host controlado por el atacante en lugar de gitlab.com. Esto puede conducir a phishing de credenciales y a la exfiltraci\u00f3n de tokens de estado de sesi\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 29.7.9."}], "lastModified": "2026-10-26T18:10:00.173", "sourceIdentifier": "security-advisories@github.com"}