CVE-2026-73037 MEDIUM

CVE-2026-73037: Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter

Vendor Dayuanjiang

Product next-ai-draw-io

Weakness CWE-79 · XSS

Published August 13, 2026

Last update August 14, 2026

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration of diagram sessions and API data.

Key dates

02Disclosure timeline

August 13, 2026 CVE published

August 14, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-73037 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities

04Related CVE

CVE-2026-73340 WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability CVE-2026-66690 WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-28175 WordPress Visitors Traffic Real Time Statistics plugin <= 8.11 - Cross Site Scripting (XSS) vulnerability CVE-2026-19794 WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting CVE-2026-3639 PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes