What is the CVSS score of CVE-2026-50756?

CVE-2026-50756 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of next-ai-draw-io are affected by CVE-2026-50756?

DayuanJiang next-ai-draw-io 0.4.13, an open-source AI-powered diagram generation application, contains an unauthenticated information disclosure vulnerability in its x-ai-provider component that…

How to fix or mitigate CVE-2026-50756?

Within 24 hours: inventory all systems running next-ai-draw-io version 0.4.13 or earlier, document network exposure (internet-facing vs. internal-only), and identify which teams depend on the x-ai-provider feature. Within 7 days: disable or isolate the x-ai-provider component via network firewall rules if operationally feasible, or restrict application access to internal networks only (VPN/corporate network boundary); implement API request logging for forensic detection of exploitation attempts. Within 30 days: monitor DayuanJiang project releases and security advisories for a patched version; evaluate alternative open-source or commercial diagram-generation tools that do not carry this flaw; if next-ai-draw-io must remain in production, ensure it operates exclusively in segmented, trusted network zones with strict access controls and multi-factor authentication for administrative access.

next-ai-draw-io CVE-2026-50756

HIGH

Weak Authentication (CWE-1390)

2026-07-21 mitre

Information Disclosure N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable and unauthenticated per reported weak-authentication flaw (PR:N/AV:N/AC:L); impact is confidentiality-only information disclosure, so I:N and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:35 vuln.today

CVSS changed

Jul 22, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jul 21, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Jul 21, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component

AnalysisAI

Information disclosure in DayuanJiang next-ai-draw-io 0.4.13, an open-source Next.js application that generates draw.io diagrams via AI providers, allows a remote attacker to obtain sensitive information through the x-ai-provider component. The flaw is reported as unauthenticated and network-reachable (CVSS 7.5, confidentiality-only), and no public exploit was identified at time of analysis, though a third-party technical write-up exists. EPSS is low (0.22%, 13th percentile) and the CVE is not listed in CISA KEV.

Technical ContextAI

next-ai-draw-io is a TypeScript/Next.js web application that wraps AI model providers to translate natural-language prompts into draw.io/Excalidraw diagrams. The affected element is the 'x-ai-provider' component, an HTTP-header/provider-selection mechanism used to route requests to a configured AI backend. The assigned weakness CWE-1390 (Weak Authentication) indicates the root cause is an insufficient or missing authentication/authorization control on that provider path, permitting a client to reach or read data (plausibly provider configuration, API keys, or backend responses) it should not. The single reported version is 0.4.13; CPE data is a placeholder ('n/a') and does not enumerate a proper vendor:product tuple.

RemediationAI

No vendor-released patch version was identified at time of analysis; the disclosure appears in open upstream issue #749 (https://github.com/DayuanJiang/next-ai-draw-io/issues/749) with additional detail in an independent write-up (https://github.com/August829/Yu/blob/main/CVE-2026-50756.md), so monitor that repository for a fixed release and upgrade beyond 0.4.13 once published. Until a fix ships, place the application behind an authenticating reverse proxy or network ACL so the x-ai-provider path is not reachable by unauthenticated remote clients (trade-off: breaks any intended anonymous/public access to the diagram service), restrict or filter the x-ai-provider request header at the proxy layer, and rotate any AI provider API keys or secrets that could be exposed through the component. Because this is a self-hosted hobby project, avoid exposing the instance directly to the public internet.