CVE-2026-73037

Name of the Vulnerable Software and Affected Versions Next AI Draw.io versions 0.2.1 through 0.4.16

Description A reflected cross-site scripting issue exists where the mcp query parameter is interpolated into HTML and JavaScript without proper escaping. This allows attackers to use malicious URLs to execute arbitrary JavaScript within the localhost origin, which can lead to the exfiltration of API data and diagram sessions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the mcp query parameter until the issue is resolved.