---
id: CVE-2026-72777
title: >-
  Next AI Draw.io through 0.4.16 contains a server-side request forgery
  vulnerability in the POST /api/parse-url endpoint due to hostname validation
  that only checks string patterns without DNS resolution
summary: >-
  Next AI Draw.io through 0.4.16 contains a server-side request forgery
  vulnerability in the POST /api/parse-url endpoint due to hostname validation
  that only checks string patterns without DNS resolution. Unauthenticated
  attackers can sup…
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-918
published: '2026-08-13'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:35:08.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72777'
references:
  - url: 'https://github.com/DayuanJiang/next-ai-draw-io/issues/918'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/next-ai-draw-io-ssrf-via-dns-rebinding-in-parse-url
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00317
epssPercentile: 0.24863
ingestedAt: '2026-09-09T21:22:45.534Z'
vendor: DayuanJiang
product: next-ai-draw-io
affected:
  - next-ai-draw-io <= 0.4.16
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-08-13T18:41:26.347823Z'
---

## Overview

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to internal addresses, allowing them to reach arbitrary internal HTTP services and exfiltrate responses including cloud metadata.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.