Skip to content
OpenAdvisories

Vendor

DayuanJiang

3 known vulnerabilities.

Products

next-ai-draw-io 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-73037

    Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter

    Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the l…

    DayuanJiang next-ai-draw-io
  • Medium 6.2
    CVE-2026-40608

    Next AI Draw.io: Unbounded HTTP Body — Denial of Service

    Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidecar contains three POST handlers (/api/state, /api/restore, and /api/history-svg) that process incoming requests by accu…

    DayuanJiang next-ai-draw-io