What is the CVSS score of CVE-2026-50757?

CVE-2026-50757 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of next-ai-draw-io are affected by CVE-2026-50757?

next-ai-draw-io version 0.4.13 contains a path traversal vulnerability enabling arbitrary code execution on systems running the application.

How to fix or mitigate CVE-2026-50757?

Within 24 hours, inventory all systems running next-ai-draw-io 0.4.13 and assess business criticality; for non-critical deployments, consider disabling the application until patched. Within 7 days, implement network-level access controls restricting the bundled MCP server component to trusted internal networks only, and enable detailed logging of server requests and file system activities to detect exploitation attempts. Within 30 days, monitor the DayuanJiang project for patch availability and plan immediate migration to any released patched version; if no patch is released within 60 days, evaluate replacement with alternative diagramming tools without this vulnerability.

next-ai-draw-io CVE-2026-50757

HIGH

Path Traversal (CWE-22)

2026-07-21 mitre

RCE Path Traversal N A

7.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

MCP server runs locally and is invoked through the user's agent, so AV:L and UI:R; no auth is enforced (PR:N) and traversal-to-RCE yields full C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:34 vuln.today

CVSS changed

Jul 22, 2026 - 18:22 NVD

7.8 (HIGH)

CVE Published

Jul 21, 2026 - 00:00 cve.org

HIGH 7.8

CVE Published

Jul 21, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary code via the nex-ai-draw-io/mcp-server

AnalysisAI

Arbitrary code execution in DayuanJiang next-ai-draw-io 0.4.13 arises from a path traversal flaw in the bundled MCP (Model Context Protocol) server, allowing an attacker who can influence a request to the mcp-server component to write or access files outside the intended directory and ultimately run code on the host. The affected product is a niche open-source AI-assisted draw.io diagramming application. No public exploit has been confirmed, though a third-party technical writeup exists; EPSS is low (0.43%, 35th percentile) and the flaw is not in CISA KEV.

Technical ContextAI

next-ai-draw-io is a Next.js web application that pairs an AI chat/agent interface with draw.io diagram generation and ships an MCP server so LLM agents can invoke local tooling. The vulnerability is classified CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): the mcp-server handles a file path parameter without properly canonicalizing or constraining it, so sequences such as '../' escape the intended working directory. Because MCP tools typically run with the privileges of the user's local agent process and can write to arbitrary filesystem locations, an out-of-bounds write can be chained into arbitrary code execution (e.g., dropping or overwriting an executable, script, or config that later runs). The supplied CPE string (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not identify the product programmatically.

RemediationAI

No vendor-released patch identified at time of analysis; the only vendor reference is an open GitHub issue (https://github.com/DayuanJiang/next-ai-draw-io/issues/754), so monitor that issue and the project releases for a fixed version above 0.4.13 and upgrade as soon as one ships. As compensating controls until a fix exists: do not run the mcp-server component in untrusted or shared environments; if the MCP server is not needed, disable or do not register it with your agent runtime (trade-off: loses AI-driven diagram tooling); restrict the process to a dedicated low-privilege user and a chroot/container with a read-only filesystem outside the intended working directory to blunt traversal-based writes (trade-off: added operational complexity); and avoid feeding untrusted content or prompts into the agent that could carry crafted file paths. Consult the third-party writeup (https://github.com/August829/Yu/blob/main/CVE-2026-50757.md) for the specific vulnerable path parameter to inform input filtering.