A crafted .drawio file can cause attacker‑controlled JavaScript to run in the draw.io origin when cells are processed by TextFormatPanel.addFont(). The flaw bypasses earlier remediation by exploiting a sibling plain‑text cell that is not properly escaped. Successful exploitation gives an attacker access to diagram contents, browser storage, non‑HttpOnly cookies, and same‑origin actions. The weakness resides in improper string handling (CWE‑116) and cross‑site scripting (CWE‑79).

The vulnerability affects all versions of jgraph:drawio older than 30.2.5. Users must upgrade to version 30.2.5 or later to eliminate the flaw.

The CVSS score of 6.1 indicates moderate risk. EPSS data is unavailable, and the vulnerability is not listed in the KEV catalog. The attack vector is inferred to be a user‑initiated file import or opening of a malicious diagram. An attacker must convince a victim to load a crafted file, after which the script runs with the same privileges as the web app. Due to the lack of a publicly known widespread exploitation and the requirement for user interaction, the exploitation probability is considered low to moderate.