DayuanJiang/next-ai-draw-io

GitHub

github.com

next-ai-drawio.jiang.jp

Releases18

Frequency1 week 3 days

Last Release2 months ago

Stars33.8K

A next.js web application that integrates AI capabilities with draw.io diagrams. This app allows you to create, modify, and enhance diagrams through natural language commands and AI-assisted visualization.

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2026-50758NVD↗	—	Jul 21, 2026Tuesday, 21 July 2026, 20:17	8.1 HIGH	—
Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary code via the mcp parameter
CVE-2026-50755NVD↗	—	Jul 21, 2026Tuesday, 21 July 2026, 20:17	9.8 CRITICAL	—
An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value
CVE-2026-50756NVD↗	—	Jul 21, 2026Tuesday, 21 July 2026, 20:17	7.5 HIGH	—
An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component
CVE-2026-50757NVD↗	—	Jul 21, 2026Tuesday, 21 July 2026, 20:17	7.8 HIGH	—
Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary code via the nex-ai-draw-io/mcp-server
CVE-2026-40608NVD↗	< 0.4.15	Apr 21, 2026Tuesday, 21 April 2026, 18:16	6.2 MEDIUM	—
Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidecar contains three POST handlers (/api/state, /api/restore, and /api/history-svg) that process incoming requests by accumulating the entire request body into a JavaScript string without any size limitations. Node.js buffers the entire payload in the V8 heap. Sending a sufficiently large body (e.g., 500 MiB or more) will exhaust the process heap memory, leading to an Out-of-Memory (OOM) error that crashes the MCP server. This vulnerability is fixed in 0.4.15.