ID:12862 - Exploit for Prototype pollution in draw.io

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation in mxGraphMlCodec. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.

Remediation