Executive brief
A security vulnerability exists in the next-ai-draw-io MCP server, a tool used to help AI agents like Claude and VS Code Copilot generate diagrams. By tricking a user into clicking a specially crafted link, an attacker can execute malicious code in the user's browser. This could allow the attacker to steal diagram data, modify active projects, or access sensitive intellectual property stored within the application.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in the @next-ai-drawio/mcp-server component of next-ai-draw-io. The vulnerability is located in `packages/mcp-server/src/http-server.ts`, where the `mcp` query parameter (representing a session ID) is read and interpolated directly into both HTML and JavaScript contexts without sanitization or escaping. Specifically, the input is placed inside a JavaScript string literal in a `<script>` block, allowing an attacker to break out of the string using a double-quote character and execute arbitrary code. The impact is further escalated by a wildcard CORS configuration (`Access-Control-Allow-Origin: *`) on the local HTTP server, enabling the injected script to exfiltrate diagram data via the server's API endpoints.
Affected products
- DayuanJiang next-ai-draw-io <= 0.4.13
- DayuanJiang @next-ai-drawio/mcp-server <= 0.1.16
Timeline
- 2026-03-17: disclosed: Vulnerability discovered
- 2026-07-21: advisory: CVE published by NVD/MITRE