Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck

CVE-2026-72777Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url

High 8.6

In plain English

A high-severity server-side request forgery in next-ai-draw-io from DayuanJiang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.4%top 62.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to internal addresses, allowing them to reach arbitrary internal HTTP services and exfiltrate responses including cloud metadata.

Affected products (as reported)

Vendor	Product	Versions
DayuanJiang	next-ai-draw-io	0 – through 0.4.16

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

Researcher Disclosure technical-description, exploit, issue-tracking
https://www.vulncheck.com/advisories/next-ai-draw-io-ssrf-via-dns-rebinding-in-parse-url third-party-advisory