Description

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration of diagram sessions and API data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-13T19:17:33.960Z",
  "pubdate": "2026-08-13T19:17:33.960Z",
  "executiveSummary": "Next AI Draw.io versions 0.2.1 through 0.4.16 contain a reflected cross-site scripting (XSS) vulnerability residing in the mcp query parameter. The flaw stems from the direct interpolation of user-supplied input into HTML and JavaScript contexts without proper sanitization or encoding. Successful exploitation allows an attacker to craft malicious URLs that, when processed by the application, execute arbitrary JavaScript within the localhost origin.\nThe primary impact of this vulnerability includes the potential exfiltration of sensitive diagram sessions and API data. Because the execution occurs in the context of the localhost origin, the compromise can affect local application state and data access. The attack requires user interaction, specifically tricking a victim into clicking a maliciously crafted URL containing the payload in the mcp parameter.",
  "technicalDetails": "The vulnerability is classified as a reflected cross-site scripting (XSS) flaw affecting Next AI Draw.io versions 0.2.1 through 0.4.16. The root cause of the issue is the insecure handling of the mcp query parameter. Specifically, the application takes the input supplied via the mcp parameter and dynamically interpolates it directly into the generated HTML and JavaScript outputs without applying contextual escaping or input validation.\nExploitation of this vulnerability occurs via the network exposure of the local application instance. An attacker crafts a malicious URL targeting the vulnerable endpoint, appending an arbitrary JavaScript payload within the mcp query parameter. No authentication or elevated privileges are required to deliver the payload, provided the victim can be induced to access the crafted link.\nThe attack flow proceeds as follows: First, the attacker constructs the malicious URL containing the XSS payload in the mcp parameter. Second, the victim requests this URL from the local instance of Next AI Draw.io. Third, the application processes the request, extracts the value of the mcp parameter, and embeds it directly into the HTML and JavaScript response stream without encoding. Fourth, the victim's browser parses the response and executes the embedded JavaScript payload within the localhost origin context.\nPost-exploitation impact involves the execution of arbitrary script logic in the context of the application's origin. This enables the malicious script to access local storage, session data, and interact with local APIs, leading directly to the exfiltration of sensitive diagram sessions and proprietary API data processed by the application."
}