CVE-2026-114606: 
JavaScript vulnerability analysis and mitigation

CVE-2026-114606 is an arbitrary local-file disclosure vulnerability in draw.io Desktop (the official Electron build of draw.io) affecting all versions prior to 31.4.4. The flaw stems from a read/write authorization asymmetry in the Electron main process's IPC handlers: write-side handlers are protected by assertWritablePath, but the read-side handlers (readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, watchFile) have no equivalent blessed-path gate. It was reported by security researcher Ahmed Ibrahim (@skeletonsec) and patched in version 31.4.4, released September 6, 2026. The vulnerability carries a CVSS v4.0 base score of 5.6 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-22 (Path Traversal) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The readFile() function in src/main/electron.js reads a renderer-supplied filesystem path with only two weak controls: validateSender() (a URL-prefix origin check that any renderer-side XSS would also pass) and a content "sniff" plus a lexical appBaseDir prefix block (using path.resolve, not realpath, so symlinks are not defeated). Files beginning with { or [ (JSON, INI, TOML configs) pass the content sniff, and any path outside the application install directory bypasses the appBaseDir check entirely. The sibling handlers getFileDrafts and getBkpFile have no content sniff at all, and fileStat/isFileWritable/checkFileExists/watchFile are completely ungated metadata oracles. Exploitation requires code execution in the app's file:// origin — achievable via a renderer-side XSS triggered by opening a crafted diagram file — which is the exact threat model the code's own comments acknowledge as passing validateSender (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to read arbitrary local files accessible to the user running draw.io Desktop, including JSON configuration files, credentials, saved diagrams, exported PDFs, PNGs, and HTML files — any file whose content passes the magic-byte sniff or whose extension matches .mmd/.mermaid. The impact is limited to confidentiality (no integrity or availability impact), but sensitive files such as SSH keys stored as JSON wrappers, application config files, or browser-exported data could be exfiltrated to the renderer and subsequently transmitted to an attacker-controlled server. The attack vector is local and requires user interaction (opening a crafted diagram), limiting mass exploitation, but targeted attacks against users who open untrusted diagram files are realistic (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The GitHub Security Advisory includes a detailed proof-of-concept demonstrating the IPC primitive, but exploitation requires a renderer-side XSS as a precondition, which raises the practical bar. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score or threat actor attribution is currently available. The CVE status is listed as "Awaiting Analysis" (GitHub Advisory, Feedly).

1. Craft a malicious diagram file: Create a draw.io diagram (.drawio or .xml) that embeds a crafted cell style with a fontSource attribute pointing to a sensitive local file path (e.g., ~/.config/app/credentials.json or a JSON-formatted secrets file).
2. Deliver the diagram to the target: Social-engineer the victim into opening the crafted diagram file in draw.io Desktop (e.g., via email attachment, shared link, or supply-chain compromise of a shared diagram repository).
3. Trigger renderer-side XSS or leverage diagram content parsing: Opening the crafted diagram causes the draw.io webapp renderer to parse attacker-controlled XML/SVG/Mermaid content. The fontSource cell style value is fetched through the readFile IPC handler without a blessed-path check.
4. Invoke the unprotected IPC handler: From the renderer's file:// origin context, call the preload bridge: window.electron.request({ action: 'readFile', filename: '/path/to/sensitive/file.json', encoding: 'utf8' }, (data) => { /* exfiltrate data */ }, (err) => {}). The main process returns the file contents verbatim if the content passes the magic-byte sniff (e.g., file starts with {).
5. Exfiltrate the data: The renderer receives the file contents and can transmit them to an attacker-controlled server via an outbound HTTP request or embed them in a diagram export.
6. Export to capture embedded data: Alternatively, trigger an export (PNG, SVG, PDF) of the crafted diagram — the fontSource file contents are base64-embedded in the export artifact, which the attacker can then retrieve (GitHub Advisory, Fix Commit).

• File System: Unexpected diagram export files (PNG, SVG, PDF) containing base64-encoded content of local configuration or credential files; crafted .drawio or .xml files with fontSource attributes referencing local filesystem paths (e.g., fontSource="file:///home/user/.config/...").
• Network: Outbound HTTP/HTTPS requests from the draw.io Desktop process to unexpected external hosts shortly after opening a diagram file, potentially carrying base64-encoded payloads in request bodies or query parameters.
• Logs: Application logs showing readFile IPC calls with paths outside the user's normal diagram working directory; errors or unusual activity in Electron renderer logs referencing local file paths not associated with diagram files.
• Process: The draw.io Desktop Electron process making filesystem reads to sensitive directories (e.g., ~/.ssh/, ~/.config/, ~/Documents/) not initiated by a user file-open dialog, observable via filesystem audit tools (e.g., auditd on Linux, Sysmon on Windows with file access events).

Users should upgrade draw.io Desktop to version 31.4.4 or later, which introduces assertReadablePath — mirroring the existing assertWritablePath — and applies it to all read-side IPC handlers (readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, watchFile). The fix also replaces the lexical appBaseDir check with a realpath-canonicalized form to defeat symlink traversal. There is no user-facing workaround for the read-side gap; the vendor recommends only opening diagram files from trusted sources as a risk-reduction measure until patching is possible (GitHub Release, GitHub Advisory).

The vulnerability was reported by security researcher Ahmed Ibrahim (@skeletonsec) and credited in the official GitHub Security Advisory. The fix commit message and release notes explicitly acknowledge the read/write authorization asymmetry and the attack path via crafted diagram export. Community reaction on GitHub was modest, with 4 heart reactions on the release. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified at this time (GitHub Advisory, GitHub Release).