CVE-2026-73037

MediumCVSS 6.1/10Last modified Sep 9, 2026

Description

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration of diagram sessions and API data.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 13, 2026
Last modified: Sep 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-730386.1NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and CVE-2026-730395.4streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and de CVE-2026-73049.8SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option CVE-2026-730408.8Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to mat CVE-2026-730419.0SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can CVE-2026-730429.0SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when us CVE-2026-730439.0SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authore CVE-2026-730449.0SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into styl CVE-2026-730457.5SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoin CVE-2026-730469.8SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication bra CVE-2026-730476.2siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation CVE-2026-730485.8SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block