Executive brief
A security flaw in the next-ai-draw-io application allows unauthorized individuals to intercept sensitive information. By manipulating how the application connects to AI services, an attacker can trick the server into sending private conversation history, diagram data, and internal system instructions to a server they control. This could lead to the exposure of proprietary business logic and confidential user designs.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in next-ai-draw-io version 0.4.13 and earlier due to an incomplete fix for a previous SSRF issue (GHSA-9qf7-mprq-9qgm). The application's SSRF guard in `lib/ai-providers.ts` explicitly exempts the 'edgeone' and 'ollama' providers from requiring an API key when a custom `baseUrl` is provided. By supplying the `x-ai-provider: edgeone` and `x-ai-base-url` headers, a remote unauthenticated attacker can redirect server-side AI API calls to an arbitrary endpoint. This results in the server sending a POST request containing the full AI system prompt (approx. 18KB), user conversation history, and diagram XML to the attacker-controlled server.
Affected products
- DayuanJiang next-ai-draw-io <= 0.4.13
Timeline
- 2026-03-17: disclosed: Vulnerability discovered and reported to vendor via GitHub issue.
- 2026-07-21: advisory: CVE-2026-50756 published.