CVE-2026-73037

Executive Summary

CVE-2026-73037 is a reflected cross-site scripting (XSS) vulnerability in Next AI Draw.io, a diagramming application by Thomas Eichmann, affecting versions 0.2.1 through 0.4.16. The flaw exists in the mcp query parameter, which is interpolated without escaping into HTML and JavaScript output, allowing an unauthenticated attacker to execute arbitrary JavaScript within the vulnerable application's localhost origin. Successful exploitation enables the exfiltration of diagram sessions and API data; a patch is claimed by a single source (OSV) but has not been independently confirmed.

Technical Analysis

The vulnerability is a classic reflected XSS (CWE-79) in the mcp query parameter of Next AI Draw.io. The NVD description states that the parameter is "interpolated without escaping into HTML and JavaScript," meaning that when a user requests a URL containing a mcp value, the application echoes that value back into the rendered page in one or more contexts — an HTML context and/or an inline JavaScript context — without applying sanitization, output encoding, or contextual escaping. An attacker who controls the mcp value therefore controls the structure of the resulting document and can inject arbitrary script code that is parsed and executed by the victim's browser.

Notable characteristics of the flaw:

• Reflection mechanism: The injected payload travels in the URL query string and is reflected in the HTTP response. No authentication is required to trigger the reflection (CVSS PR:N), but user interaction — clicking a crafted link — is required (CVSS UI:R), which is consistent with the reflected XSS class.
• Localhost origin context: The description specifically calls out the "localhost origin." Browsers treat http://localhost (and http://127.0.0.1) as a trustworthy origin in many configurations. Script running with that origin's privileges can read same-origin resources — including diagram session data held in local browser storage, DOM state, or client-side application state — and can issue same-origin fetch/XMLHttpRequest calls against the application's local API endpoints, which may expose user diagram content and API keys/tokens.
• Attack surface: The vulnerable entity is the application's HTTP interface that renders the mcp parameter. Because the product is oriented toward a localhost deployment, the attack surface in practice is the victim's browser plus whatever network path exists to the application (e.g., browser-launched local server, port forwarding, or accidental exposure of the local service to the LAN/Internet).
• Version scope: Affected versions are 0.2.1 through 0.4.16 (inclusive). No fixed version has been disclosed in the available data; the OSV record lists the package as unfixed, even though a single-source claim of a patch exists.

Specific code-level details — exact handler functions, template files, or endpoint paths — are not provided in the NVD description. Sufficient technical detail is not available to name the vulnerable code path; the analysis above is drawn strictly from the vulnerability class and the parameter name, mcp, which is the only implementation detail disclosed.

Exploitation Scenarios

No public PoC or exploit code has been identified for CVE-2026-73037 as of this report. The attack chain below is inferred from the vulnerability class (reflected XSS in a localhost-origin web application) and the NVD description.

1. Reconnaissance / target identification: The attacker identifies a target running Next AI Draw.io 0.2.1–0.4.16. Since the application executes in a localhost origin, the attacker may not be able to reach it directly over the network unless the service is exposed via port forwarding, a browser extension, a tunnel, or a misconfigured firewall. In a typical scenario, the attacker targets a specific user known to run the application, or relies on the application being reachable through a shared/remote development environment.

2. Crafting and delivering the trigger: The attacker constructs a malicious URL pointing to the application's HTTP interface with the mcp parameter set to a JavaScript payload — e.g., an HTML <script> block, an event-handler attribute, or a javascript:-style vector, either raw or URL-encoded. The URL is delivered to the victim via phishing email, instant messaging, forum posts, or any channel that induces a click. Because the application is reachable at the victim's localhost, the attacker typically links to http://localhost:<port>/...?...mcp=<payload>, possibly through a redirect or link-shortener to hide the destination.

3. Vulnerability trigger / execution: When the victim clicks the link, the browser requests the URL from the local Next AI Draw.io instance. The server reflects the mcp value into the HTML/JavaScript response without escaping. The browser interprets the attacker-controlled content as executable code and runs it with the privileges of the localhost origin — i.e., the same-origin context of the application.

4. Post-exploitation impact: The injected JavaScript can read in-memory/on-page diagram session data, read API responses or stored credentials accessible from the application's origin, and make arbitrary same-origin requests to the application's API. The script can then exfiltrate the collected data by issuing outbound network requests to attacker-controlled infrastructure (subject to CORS, CSP, and mixed-content restrictions). In the worst case, the attacker obtains diagram contents, session tokens, and API data, and can perform state-changing actions on behalf of the victim within the application.

Impact Assessment

The CVSS score of 6.1 (Medium) reflects the following risk profile:

• Attack vector (AV:N): The vulnerability is exploitable over a network — the crafted URL can be delivered remotely, even though the vulnerable service itself may reside on localhost.
• Attack complexity (AC:L) and privileges (PR:N): No special conditions or pre-required privileges are needed beyond the user clicking a link.
• User interaction (UI:R): Exploitation depends on the victim clicking or otherwise opening a crafted URL — the primary limiting factor for mass exploitation.
• Scope (S:C): A successful injection impacts a security context (the localhost origin / application data) beyond the vulnerable component's immediate boundary.
• Confidentiality (C:L) and Integrity (I:L): Partial loss of confidentiality of diagram sessions and API data; partial loss of integrity via injected content or unauthorized in-application actions. No direct availability impact (A:N).

Business impact: For an organization using Next AI Draw.io to handle sensitive diagrams, architecture documentation, or API-connected workflows, successful exploitation can leak proprietary design information, session tokens, and API credentials. The confidentiality impact is particularly relevant when the application stores API keys for downstream integrations (e.g., AI or diagram-storage services). Because exploitation requires user interaction and targets a localhost-bound application, the realistic risk is targeted phishing-style attacks against individual users rather than mass internet-wide scanning.

Exploitation likelihood: EPSS places this CVE at approximately 0.00155, in the 5.1st percentile of exploited CVEs — indicating a very low current probability of in-the-wild exploitation. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No known threat-actor campaigns have been attributed to this CVE in the available data.

Detection Guidance

The following detection logic targets the observable artifact of this vulnerability class: HTTP requests whose mcp parameter contains reflected-XSS payload indicators. Rules are generic to the parameter name and should be tuned to local log formats and false-positive rates.

Sigma Rule

title: Reflected XSS Attempt Against Next AI Draw.io mcp Parameter
id: 3f7c92e0-2026-4a1c-9b5a-730370000001
status: experimental
description: >
  Detects HTTP requests containing common reflected-XSS payload indicators in the
  "mcp" query parameter, associated with CVE-2026-73037 (Next AI Draw.io 0.2.1 - 0.4.16).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73037
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_param:
    cs-uri-query|contains: "mcp="
  selection_payload:
    cs-uri-query|contains:
      - "<script>"
      - "%3Cscript%3E"
      - "javascript:"
      - "onerror="
      - "onload="
      - "%3Csvg%20onload"
      - "document.cookie"
      - "fetch("
      - "eval("
  condition: selection_param and selection_payload
falsepositives:
  - Security scanners and automated crawlers
  - Benign application traffic where the mcp parameter legitimately contains encoded markup
level: high
tags:
  - attack.t1189
  - cve.2026.73037
  - cwe.79

YARA Rule

rule CVE_2026_73037_NextAI_Drawio_Reflected_XSS
{
    meta:
        author      = "Valtersit Threat Intelligence"
        description = "Detects reflected-XSS payload strings targeting the mcp parameter of Next AI Draw.io (CVE-2026-73037)"
        cve         = "CVE-2026-73037"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-73037"
        date        = "2026-01-01"
    strings:
        $p1 = "mcp=<script>" ascii nocase
        $p2 = "mcp=%3Cscript%3E" ascii nocase
        $p3 = "mcp=javascript:" ascii nocase
        $p4 = "mcp=\"onerror=" ascii nocase
        $p5 = "mcp=%22onerror%3D" ascii nocase
        $p6 = "mcp='onload=" ascii nocase
        $p7 = "mcp=%3Cimg%20src=x%20onerror=" ascii nocase
        $p8 = "mcp=*document.cookie" ascii nocase
    condition:
        any of ($p*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73037 Next AI Draw.io Reflected XSS in mcp Parameter"; flow:established,to_server; http.uri; content:"mcp="; nocase; pcre:"/mcp=[^&]*?(<script|%3Cscript|javascript:|onerror=|onload=|%3Cimg|document\.cookie)/i"; classtype:web-application-attack; reference:cve,2026-73037; sid:202673037; rev:1;)

Elastic Detection

any where
  url.query != null and
  (
    url.query like~ "*mcp=<script>*" or
    url.query like~ "*mcp=%3Cscript%3E*" or
    url.query like~ "*mcp=javascript:*" or
    url.query like~ "*mcp=*onerror=*" or
    url.query like~ "*mcp=*onload=*" or
    url.query like~ "*mcp=*document.cookie*"
  )

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_query, "%mcp=%")
  and (like(uri_query, "%<script>%")
       OR like(uri_query, "%3Cscript%3E")
       OR like(uri_query, "%javascript:%")
       OR like(uri_query, "%onerror=%")
       OR like(uri_query, "%onload=%"))
| stats count min(_time) as first_seen max(_time) as last_seen
        by src_ip, dest_ip, uri_path, uri_query, http_user_agent
| sort - count

Wazuh OSSEC Rule

<group name="web,">
    <rule id="438369" level="10">
        <decoded_as>web</decoded_as>
        <match>mcp=</match>
        <regex>mcp=(&lt;|%3C)script|mcp=javascript:|mcp=.*(onerror|onload)=|mcp=.*document\.cookie</regex>
        <description>CVE-2026-73037: Possible reflected XSS attempt against Next AI Draw.io "mcp" parameter</description>
        <mitre>
            <id>T1189</id>
        </mitre>
        <group>attack.initial_access,xss,cve202673037,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is low (2/4 — CLAIMED). The only patch source is OSV, and the claim is not independently confirmed. The OSV package entry for this CVE lists the affected range as unfixed (0 → unfixed), meaning no fixed version is currently published in that record. Organizations should treat the patch status as unverified and rely on compensating controls.

1. Immediate mitigations:

   • Restrict network access to the Next AI Draw.io service. If it must bind to a socket, bind only to 127.0.0.1 and ensure firewalls block external access to the listening port.
   • Deploy a WAF or reverse-proxy rule that blocks or sanitizes requests whose mcp parameter contains common XSS indicators (<script>, javascript:, onerror=, onload=, encoded variants).
   • Educate users not to click untrusted links that reference localhost/loopback addresses; treat any URL pointing to a local service as high-risk.
   • Monitor application logs and web-server access logs for anomalous mcp parameter values.

2. Patch / upgrade steps:

   • Contact the vendor (Thomas Eichmann / Next AI Draw.io maintainers) to confirm the claimed patch and obtain the patched version identifier.
   • Upgrade to the fixed release once it is confirmed available; verify the package checksum/hash against the vendor's published values.
   • Re-run the affected-version inventory across the organization to confirm no instance remains on 0.2.1–0.4.16 after the upgrade.

3. Long-term hardening:

   • Require context-aware output encoding/sanitization for all user-controlled input reflected into HTML or JavaScript, with unit and DAST coverage for the mcp parameter.
   • Implement a strict Content Security Policy (CSP) that disallows inline scripts, reducing the impact of any residual XSS.
   • Set HttpOnly and Secure flags on cookies and avoid storing API keys in browser-accessible storage.
   • Integrate SAST/DAST into the development pipeline and subscribe to OSV/NVD advisories for the product so future patches are confirmed promptly.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73037
• OSV Vulnerability Record (patch source of record): https://osv.dev/vulnerability/CVE-2026-73037
• CWE-79 — Improper Neutralization of Input During Web Page Generation: https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK — T1189 Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-73037 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No evidence of in-the-wild exploitation, exploit-db activity, or known threat-actor campaigns is available at the time of writing. The CVE is not in CISA KEV, and no Nuclei template or public exploit code has been identified.