CVE-2026-119333

The record

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.

Affected packages

Related vulnerabilities

• CVE-2026-116243 pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets… CWE-426
• CVE-2026-57203 Asterisk is an open source private branch exchange and telephony toolkit. CWE-426
• CVE-2026-105477 A vulnerability in Veeam Agent for Linux allows for local privilege escalation. CWE-426
• CVE-2026-113461 Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to… CWE-426
• CVE-2026-83509 Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to… CWE-426
• CVE-2026-83506 Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate… CWE-426
• CVE-2026-83505 Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows… CWE-426
• CVE-2026-70142 Untrusted search path in Windows Update Service allows an authorized attacker to elevate… CWE-426