CyberRota Analysis
AI-GeneratedNext AI Draw.io versions 0.2.1 to 0.4.16 are vulnerable to a reflected cross-site scripting (XSS) flaw in the mcp query parameter, which is improperly interpolated into HTML and JavaScript without adequate escaping. This vulnerability allows attackers to craft malicious URLs that can execute arbitrary JavaScript in the localhost context, potentially leading to the exfiltration of sensitive diagram sessions and API data. Organizations using affected versions should prioritize patching this vulnerability to mitigate risks associated with unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration of diagram sessions and API data.