Security

SECURITY.md

Security Policy

Supported Versions

We only accept security reports against the latest version in this repo or the version deployed to app.diagrams.net, if different.

Reporting a Vulnerability

Report at https://huntr.dev/bounties/disclose?target=https%3A%2F%2Fgithub.com%2Fjgraph%2Fdrawio&validSearch=true. There is a bug bounty program in place there.

Out of scope

Issues relating to the PlantUML integration.
Issues relating to the www.drawio.com web site.

Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host
GHSA-8x7j-m8px-7p8x published Apr 20, 2026 by davidjgraph

Low

Learn more about advisories related to jgraph/drawio in the GitHub Advisory Database