CVE-2026-63334: medium-severity vulnerability in jgraph drawio
draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.8epss 0.3%
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in Utils.sanitizeUrl() using one DNS resolution, while src/main/java/com/mxgraph/online/ProxyServlet.java later calls URL.openConnection() and performs a second resolution. An attacker-controlled hostname can resolve to a public address during validation and then to a private, link-local, or cloud metadata address when the connection is opened. Successful exploitation can return cloud instance metadata or responses from internal HTTP services through the proxy. This issue is fixed in version 30.2.7.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
jgraph · drawioRelated CVEs — jgraph drawio
In the same product, most dangerous first.
CVE-2026-76898HIGHdraw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.jsEPSS 0.4%CVE-2026-63416LOWdraw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpointsEPSS 0.3%CVE-2026-58504MEDIUMdraw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642EPSS 0.3%CVE-2026-46642MEDIUMdraw.io: XSS via crafted cell label when opening a .drawio fileEPSS 0.2%CVE-2026-42195LOWUnvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled hostEPSS 0.2%CVE-2026-63373MEDIUMdraw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injectionEPSS 0.2%