That moment when the security patch becomes an entry point… So, Vivaldo Chagas (Nosferatu) and Lucas William found a Stored XSS vulnerability in version 30.2.4 that cleanly bypassed a previous fix from draw.io itself. draw.io is an open-source diagram editor embedded in half the corporate tools out there: Confluence, Jira, Notion, GitLab, internal wikis.

 What made this finding interesting wasn’t simply an unsanitized innerHTML. draw.io actually escapes HTML correctly across most of the codebase. The real issue was an inconsistency between two parts of the application. One component decides whether a selection can be treated as HTML by looking only at editable cells. Another component, responsible for actually processing the labels, iterates over every cell in the selection, including locked ones with editable=0. One trusts the wrong assumption made by the other. A classic confused deputy scenario! In practice, all it takes is two cells in the same diagram: one editable cell to enable HTML mode, and one locked cell carrying the payload. Simply opening the file is enough. No clicks required. The JavaScript executes in the application’s origin, giving access to whatever is available client-side: cookies, session data, localStorage, and more. Check out the article on our blog: yokai.hakaisecurity.io/en-dr… Wanna put this in practice? Take a look in the @hackingclub_io's chall “Drawing”:
app.hackingclub.com/training…