A cross-site scripting vulnerability in jgraph drawio version 30.2.5 and prior enables attackers to execute malicious scripts, posing a risk to user data and session integrity.

This is a cross-site scripting (CWE-79) vulnerability where the application fails to properly encode or escape output during the processing of cell labels. An unauthenticated attacker can trigger this by providing a crafted .drawio file that forces the application to parse plain-text labels as HTML, bypassing previous security mitigations.

Successful exploitation allows an attacker to execute arbitrary JavaScript within the context of the user session. This can lead to the exfiltration of sensitive diagram data, the theft of browser storage, the compromise of non-HttpOnly cookies, and the performance of unauthorized actions on behalf of the victim. With a CVSS score of 6.1, this medium-severity flaw represents a significant risk to organizational data confidentiality and integrity.

Immediate Action: Update jgraph drawio to version 30.2.5 or later to incorporate the necessary output encoding fixes.

Proactive Monitoring: Review web application logs for unusual file import patterns or unexpected script execution errors during diagram processing.

Compensating Controls: Deploy a Content Security Policy (CSP) to restrict the execution of inline scripts and mitigate the impact of potential cross-site scripting attacks.

Public Exploit Available: Unknown.

Organizations utilizing draw.io should prioritize the update to version 30.2.5 to eliminate this cross-site scripting vector. Given that the vulnerability is triggered by importing user-supplied files, users should exercise caution when opening diagrams from untrusted sources until the patch is fully deployed across the environment.