Vulnerabilities

TI-2026-51003 CVE-2026-72777 · GHSA-2f59-92g6-qm58

Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url

HIGH 73

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00435 Published 2026-08-13 No fix listed CWE-918

TI-2026-51246 CVE-2026-73037 · GHSA-7wvw-5p69-5396

Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter

LOW 29

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00263 Published 2026-08-13 No fix listed CWE-79

TI-2026-29344 CVE-2026-40608

Next AI Draw.io: Unbounded HTTP Body — Denial of Service

MEDIUM 61

Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00146 Published 2026-04-21 Fixed in 0.4.15 CWE-770

Vulnerabilities

Filters

Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url

Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter

Next AI Draw.io: Unbounded HTTP Body — Denial of Service