Executive brief
A vulnerability exists in the next-ai-draw-io MCP server, a tool used to allow AI assistants (like Claude or VS Code Copilot) to create and edit diagrams. Because the software does not properly check where it is saving files, a malicious actor could trick an AI agent into writing files to sensitive locations on a user's computer. This could allow an attacker to overwrite system files or plant malicious code, potentially leading to a full takeover of the user's workstation.
Technical details
A Path Traversal vulnerability (CWE-22) exists in the `export_diagram` tool of the `@next-ai-drawio/mcp-server` package. The vulnerability stems from the `path` parameter in `packages/mcp-server/src/index.ts` being passed directly to `nodePath.resolve()` and `fs.writeFile()` without any sanitization or validation against a base directory. An attacker can provide traversal sequences (e.g., `../../`) or absolute paths to write attacker-controlled diagram XML content to sensitive locations like `~/.bashrc` or cron directories. While the attack vector is local, it can be triggered remotely via prompt injection against an AI agent that has the MCP server enabled. As of the advisory date, no official patch is confirmed, though the issue has been reported to the vendor.
Affected products
- DayuanJiang next-ai-draw-io <= 0.4.13
- DayuanJiang @next-ai-drawio/mcp-server <= 0.1.16
Timeline
- 2026-03-17: disclosed: Vulnerability discovered and reported to vendor via GitHub issue.
- 2026-07-21: advisory: CVE-2026-50757 published.