CVE-2026-72777

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-72777

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72777.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-72777

Published

2026-08-13T18:23:18Z

Modified

2026-09-11T03:30:53Z

Severity

7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator

Summary

Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url

Details

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to internal addresses, allowing them to reach arbitrary internal HTTP services and exfiltrate responses including cloud metadata.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72777.json"
}

References

Affected packages

Git / github.com/dayuanjiang/next-ai-draw-io

Affected ranges

Type

GIT

Repo

https://github.com/dayuanjiang/next-ai-draw-io

Events

Introduced

Fixed

1115b2d2cdc30ffb7f7b83e1328d3ea00f8de887

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.4.16"
        },
        {
            "introduced": "Draw.io"
        },
        {
            "fixed": "0.4.16"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*

v0.2.0

v0.3.0

v0.4.0

v0.4.1

v0.4.10

v0.4.11

v0.4.12

v0.4.13

v0.4.14

v0.4.15

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.4.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72777.json"