01 Record

CVE-2026-73037

Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter

MediumPUBLISHEDCNA: VulnCheck

Base score5.1 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

02 Description

Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter

Published: 2026-08-13 18:18Z1 DAY AGO
Last updated: 2026-08-14 16:52Z1 HR AGO
Reserved: 2026-08-10
Assigning CNA: VulnCheck
Record state: PUBLISHED
Severity: Medium (CVSS 5.1)
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses: CWE-79
SSVC decision: No CISA-ADP assessment
Data version: 5.2
Document digest: 852e3e3547be6875c7ae1258e56673c632161f35d8c9008b82d8dc15f09d5573

VendorProductVersionsPlatforms

DayuanJiangnext-ai-draw-io0.2.1 to 0.4.16—