CVE-2026-46642 is a CWE-79 cross-site scripting vulnerability in jgraph drawio before version 29.7.12. The flaw is not in the label sanitizer used during rendering but in a feature-detection routine that reads raw cell labels and assigns them unsanitized to a detached element's innerHTML. Because browsers trigger onerror events even on detached elements, an attacker can embed an <img src=x onerror=...> payload in any cell label, causing script execution when the cell is selected (which happens automatically on import). This vulnerability allows arbitrary JavaScript execution in the editor's origin context. The issue is fixed in version 29.7.12.

An attacker who crafts a malicious .drawio file can execute arbitrary JavaScript in the context of the drawio editor when the file is opened and the affected cell is selected. This can lead to limited confidentiality and integrity impacts within the editor's origin, such as data exposure or manipulation. There is no impact on availability. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts.

This vulnerability is patched in drawio version 29.7.12. Users should upgrade to version 29.7.12 or later to remediate this issue. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the vendor stating the issue is fixed in 29.7.12.