Medium severity6.1NVD Advisory· Published Aug 13, 2026

CVE-2026-73037

Description

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration of diagram sessions and API data.

Affected products

Dayuanjiang/Next AI Draw Ioreferences
Next AI Draw Io/next-ai-draw-iollm-fuzzy
Range: 0.2.1 - 0.4.16

Patches

Vulnerability mechanics

References

github.com/DayuanJiang/next-ai-draw-io/issues/917nvd
www.vulncheck.com/advisories/next-ai-draw-io-reflected-xss-via-unsanitized-mcp-query-parameternvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000