CVE-2026-73037: Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter
Published Aug 13, 2026
·Updated
Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration of diagram sessions and API data.
Affected Software
1 affected component
Next AI Draw.io>=0.2.1<=0.4.16
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Next AI Draw.ioto a version that resolves this vulnerability.Fixed in 0.2.1 through 0.4.16 - Configuration
In the code path that interpolates the 'mcp' query parameter into HTML/JavaScript, ensure the value is properly escaped instead of being interpolated without escaping (reflected XSS affects versions 0.2.1 through 0.4.16).
Next AI Draw.io (mcp query parameter handling) mcp parameter output escaping = HTML/JavaScript escaping required (do not interpolate without escaping)
Event History
Aug 13, 2026
CVE Published
via MITRE·06:18 PM
Data Sourced
via MITRE·06:18 PM
DescriptionSeverityWeakness