CVE-2026-50756

Deferred Deferred - Pending Action

Remote Code Execution in DayuanJiang next-ai-draw-io

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: MITRE

Description

An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-50756

Affected Vendors & Products

Vendor	Product	Version / Range
dayuanjiang	next-ai-draw-io	0.4.13
dayuanjiang	next-ai-draw-io	to 0.4.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

CVE-2026-50756 is a Server-Side Request Forgery (SSRF) vulnerability in the next-ai-draw-io application (versions <= 0.4.13). It allows attackers to bypass an existing SSRF guard by exploiting trusted client-controlled HTTP headers (x-ai-provider and x-ai-base-url). The flaw enables redirection of server-side AI API calls to malicious endpoints.

Detection Guidance

To detect this SSRF vulnerability, monitor network traffic for unusual POST requests to external URLs from the next-ai-draw-io application. Check for headers like x-ai-provider set to 'edgeone' or 'ollama' and x-ai-base-url pointing to external domains. Inspect server logs for requests containing sensitive data like system prompts or user messages being sent to unexpected destinations.

Impact Analysis

An attacker can exploit this to send sensitive data from the server to their controlled URL. This includes the full AI system prompt (18,000+ characters), user messages, and diagram XML content. The exposed data may contain proprietary logic, confidential business information, or internal service details.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive user data and internal information. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. Exploitation may result in data breaches, legal penalties, and reputational damage.

Mitigation Strategies

Immediately upgrade to a patched version of next-ai-draw-io beyond 0.4.13. Disable or restrict access to the x-ai-provider and x-ai-base-url headers in your web server configuration. Implement strict input validation for these headers and block requests with suspicious values like 'edgeone' or 'ollama'. Review and audit all network requests originating from the application to ensure no sensitive data is being exfiltrated.

Hi! I’m here to help you understand CVE-2026-50756. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70