Prior to version 29.7.12, a specially crafted .drawio file can cause the editor to execute arbitrary JavaScript when the file is opened. The vulnerability lies not in the normal label sanitizer but in a feature‑detection routine in the Text Format panel that assigns an unchecked cell label to a detached element’s innerHTML. Because browsers trigger onerror handlers even on detached elements, an <img src=x onerror=…> payload inside any cell label initiates script execution as soon as the cell is selected, which importing does automatically.

The affected product is jgraph:drawio. All versions earlier than 29.7.12 are impacted, including 29.7.11 and any prior release.

The CVSS score of 6.1 indicates a moderate severity vulnerability. With no EPSS score available, the exploitation probability is unclear, but the issue is not listed in the CISA KEV catalog, suggesting limited operational impact. The likely attack vector is a local or remote user who can supply a malicious .drawio file for import into the editor.