Cross Site Scripting Vulnerability in DayuanJiang's next-ai-draw-io
CVE-2026-50758

8.1HIGH

Key Information:

Vendor: DayuanJiang
Status: next-ai-draw-io
Vendor: CVE Published:; 21 July 2026

🔔 Create DayuanJiang Vulnerability Alert

What is CVE-2026-50758?

A Cross Site Scripting vulnerability exists in DayuanJiang's next-ai-draw-io version 0.4.13, enabling attackers to execute arbitrary code by manipulating the 'mcp' parameter. This weakness can lead to unauthorized actions being performed in the context of the victim's session, making it critical for users to apply immediate mitigations to safeguard their applications.

References

https://github.com/DayuanJiang/next-ai-draw-io/issues/755

https://github.com/August829/Yu/blob/main/CVE-2026-50758.md

https://github.com/August829/CVEP/issues/17

CVSS V3.1

Score:

8.1

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 21, 2026
Vulnerability Reserved
Jun 7, 2026

CVE-2026-50758 Data

JSON