Description
Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration of diagram sessions and API data.
Published: 2026-08-13
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A reflected cross‑site scripting vulnerability exists in the mcp query parameter of Next AI Draw.io. Malicious content is injected into web pages without escaping, allowing attackers to execute arbitrary JavaScript in the context of the localhost origin. This can lead to exfiltration of diagram sessions and API data, potentially compromising user data confidentiality and integrity.

Affected Systems

The vulnerability affects the DayuanJiang:next‑ai‑draw‑io product, versions 0.2.1 through 0.4.16.

Risk and Exploitability

The CVSS base score of 5.1 indicates a medium severity threat. EPSS data is unavailable, so the likelihood of exploitation cannot be precisely quantified, and the vulnerability is not listed in the CISA KEV catalog. Attackers can craft malicious URLs containing arbitrary JavaScript payloads and lure users to visit them from the same localhost origin, thereby executing code in the victim’s browser session.

Generated by OpenCVE AI on August 13, 2026 at 19:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest available version of Next AI Draw.io once the vendor releases a fix for the unsanitized mcp parameter.
  • If an update is not yet available, configure a web application firewall or reverse proxy to sanitize or block malicious input on the mcp query parameter, enforcing strict input validation to prevent script injection.
  • Monitor application logs for suspicious parameter values and take remedial action if a malicious URL is detected.

Generated by OpenCVE AI on August 13, 2026 at 19:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Dayuanjiang
Dayuanjiang next-ai-draw-io
Vendors & Products Dayuanjiang
Dayuanjiang next-ai-draw-io

Thu, 13 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Description Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration of diagram sessions and API data.
Title Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Dayuanjiang Next-ai-draw-io
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-13T18:22:10.760Z

Reserved: 2026-08-10T18:48:59.023Z

Link: CVE-2026-73037

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-13T19:17:33.960

Modified: 2026-08-13T19:17:33.960

Link: CVE-2026-73037

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T20:00:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')