CVE-2026-72777CWE-918ssrf

CVE-2026-72777

High · published August 13, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
36.8
In the wild
Unconfirmed
What it is

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to internal addresses, allowing them to reach arbitrary internal HTTP services and exfiltrate responses including cloud metadata.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00435 · 36.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-13T23:17Z
References (2)
https://github.com/DayuanJiang/next-ai-draw-io/issues/918 · [email protected]https://www.vulncheck.com/advisories/next-ai-draw-io-ssrf-via-dns-rebinding-in-parse-url · [email protected]
EPSS history
Timeline
  • 13 AUG 18:23Z
    Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url
    cvelistv5