CVE-2026-119333— draw.io Desktop allows Windows executable search-path hijacking

Quick assessment

Affected

jgraph drawio-desktop

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

draw.io Desktop 是 draw.io 官方的 Electron 构建版本。在 31.5.2 版本之前，Windows 应用程序会在中通过不带路径的可执行文件名直接调用和。当 draw.io Desktop 尚未运行时，若用户从资源管理器打开某个图表文件，该图表所在目录会被设为当前工作目录。这使得攻击者预先放置的、位于同目录下的恶意或可能在系统合法可执行文件之前被解析并执行。因此，如果受害者解压了攻击者提供的存档，并在启用“本地字体”功能或更新草稿/备份属性时冷启动（即首次运行）其中合法的文

CVSS 7.8 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1566.002 · Spearphishing Link T1203.002

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

draw.io Desktop allows Windows executable search-path hijacking

Source: CVE Program / CVE List V5

Vulnerability Description

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

不可信的搜索路径

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
jgraph	drawio-desktop	< 31.5.2	-

II. Public POCs for CVE-2026-119333

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119333

请登录查看更多情报信息。

Other References for CVE-2026-119333 (3)

https://github.com/jgraph/drawio-desktop/releases/tag/v31.5.2 x_refsource_MISC
https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-qg46-52fx-h7p8 x_refsource_CONFIRM
https://github.com/jgraph/drawio-desktop/commit/3fed7ecfa6871d952d9946508ec85739796a59b2 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119333

IV. Related Vulnerabilities

Same product: drawio-desktop

CVE-2026-114606
draw.io Desktop: Arbitrary local-file read via read-side IPC

Same vendor: jgraph

Same weakness: CWE-426