CVE-2026-42195

Katalog CVE

CVSS 3.4 · Low EPSS 0,31%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor. Skor CVSS 3.1 3.4 (Low) menurut github.com.

Deskripsi (NVD)

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.

Rincian

Terbit di NVD

8 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

3.4 (Low), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/jgraph/drawio/issues/493
• https://github.com/jgraph/drawio/releases/tag/v29.7.9
• https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x