MEDIUMVulnerability
CVE-2026-73037
Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration of diagram sessions and API data.
Properties
- severity
- MEDIUM
- score
- 6.1
- epss_score
- 0.00155
- cve_id
- CVE-2026-73037
- vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- published_at
- 2026-08-13T19:17:33.960
- last_modified
- 2026-09-09T20:35:08.537
- epss_percentile
- 0.04916
Related Entities (3)
ENRICHED_BY (1)
→[Source]FIRST EPSS
DESCRIBED_BY (1)
→[Source]NVD
HAS_WEAKNESS (1)
→[Weakness]Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Explore deeper with Ninja Signal's threat intelligence graph