HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-72777 — Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerabil...

·Source: NIST NVD

Updated:

Executive Summary

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to internal addresses, allowing them to reach arbitrary internal HTTP services and exfiltrate responses inc

Analysis

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to internal addresses, allowing them to reach arbitrary internal HTTP services and exfiltrate responses including cloud metadata. CVSS Score: 8.6. Published: 2026-08-13T19:17:32.320.

Indicators of Compromise (2)

CVE (1)
CVE-2026-72777
NVDMITRE CVE
Domain (1)
Draw.io
VirusTotalURLhaus
Source Attribution

Originally published by NIST NVD on Aug 13, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

New AI Playbooks Will Target Healthcare Cyber Risk

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/new-ai-playbooks-will-target-healthcare-cyber-risk-image_small-4-a-32572.jpg" align=right hspace=4><b>Dr. Brian Anderson, CEO of the Coalition for Heath AI, on Frontier AI Threats</b><br>Frontier AI models can identify network vulnerabilities and compress attacks from days or weeks into seconds, raising the stakes for healthcare.

Bank Info Security
MEDIUMVulnerability

Friday Squid Blogging: Searching for the Colossal Squid

Fascinating video about searching for life undersea. The video basically makes the point that our bright white searchlights are scaring everything away, and that red light is more neutral. That, plus bait to attract sea creatures, is teaching us a lot about what&#8217;s going on down there. Lots of footage of giant squid, and speculation about the colossal squid. Worth watching. As usual, you can

Schneier on Security
MEDIUMVulnerability

Investigation of banking hack leads to arrests in Germany, Brazil

Germany’s federal police agency, the BKA, said three suspects were picked up in Europe and charged with fraud, and Brazil’s federal police said four others were arrested on similar charges.

The Record