Loading story…
A high-severity server-side request forgery flaw tracked as CVE-2026-72777 affects Next AI Draw.io through version 0.4.16, allowing unauthenticated remote attackers to access internal HTTP services through the application's POST /api/parse-url endpoint. The issue stems from hostname validation in isPrivateUrl() that relies on string-based checks instead of resolving DNS, enabling attackers to supply hostnames that appear external but resolve to localhost, RFC1918 addresses, or cloud metadata endpoints.
Researchers reported that the endpoint fetches attacker-supplied URLs server-side and returns extracted content, making it possible to exfiltrate responses from internal-only services. The disclosed bypass techniques include DNS rebinding, attacker-controlled DNS, and redirect chains; one proof of concept used a hostname such as 127-0-0-1.sslip.io to read data from a service bound only to 127.0.0.1:9099. The vulnerability carries a CVSS 3.1 score of 8.6, and recommended mitigations include upgrading to a patched release, validating destinations after DNS resolution, blocking redirects into private address space, and restricting server access to internal network resources.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-72777 was published for a high-severity SSRF vulnerability in Next AI Draw.io through version 0.4.16. The entry stated that the POST /api/parse-url endpoint could be exploited remotely by unauthenticated attackers to access internal HTTP services and exfiltrate responses, including cloud metadata.
A GitHub issue disclosed a high-severity SSRF vulnerability in next-ai-draw-io affecting versions up to 0.4.16. The report described how string-only hostname validation in /api/parse-url could be bypassed via DNS rebinding and related techniques, and included a proof of concept showing exfiltration from an internal-only service.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
InternLM's **LMDeploy** OpenAI-compatible API server is affected by **CVE-2026-63764**, a critical server-side request forgery flaw that lets unauthenticated attackers reach internal services by abusing image fetching in the `/v1/chat/completions` endpoint. The bug stems from validating only the initial `image_url` host and then following HTTP `302` redirects without re-checking whether subsequent destinations resolve to private or link-local addresses. As a result, an attacker can supply a public URL that redirects the server to targets such as `127.0.0.1` or the cloud metadata address `169.254.169.254`, potentially exposing internal-only applications and cloud IAM credentials. The vulnerability is tracked as **CWE-918** and has been rated **CVSS 9.2**; one affected build identified in public reporting is LMDeploy git version `648df3b`, while broader reporting says versions through **0.14.0** are impacted. A patch was merged to the main branch in **PR #4734**, but public reporting says no tagged release includes the fix yet. The issue was reportedly disclosed after a 36-day period without maintainer response following an initial report by researcher George Chen, increasing urgency for organizations running LMDeploy to review exposure and apply the upstream fix as soon as a release becomes available.
Jul 22, 2026
A critical path traversal flaw tracked as **`CVE-2026-56260`** allows unauthenticated remote attackers to write arbitrary files on servers running vulnerable versions of **Crawl4AI**. The issue affects the Docker API server’s **`/screenshot`** and **`/pdf`** endpoints, where the **`output_path`** parameter accepts absolute paths and directory traversal sequences without proper validation. The vulnerability impacts versions up to and including **`0.8.6`** and was fixed in **`0.8.7`**. By overwriting files writable by the application user, attackers could cause denial of service and compromise system integrity, including planting SSH authorized keys or injecting cron jobs for persistence. The flaw is classified as **`CWE-22`** and carries a **CVSS 9.1** rating with network-based, unauthenticated exploitation potential. Reports said no public proof-of-concept or confirmed active exploitation had emerged at publication time, and advised organizations to upgrade immediately or restrict access to the exposed endpoints as a compensating control.
Jul 13, 2026
A critical vulnerability, **CVE-2026-94545**, enables unauthenticated remote code execution in the Node.js implementation of Next.js `ImageResponse`/`next/og` when applications place attacker-controlled values into server-generated SVG elements, attributes, or styles. The issue stems from Satori failing to safely handle unescaped SVG output, allowing crafted input submitted through exposed parameters, forms, or APIs to potentially execute code on the image-generation server. Vercel fixed the flaw in Next.js **16.3.6**; versions **16.2.0 through 16.3.5** are affected. Next.js 15 and Edge-runtime `ImageResponse` deployments are not vulnerable, and Node.js deployments that never render untrusted data into SVG are not exposed through this condition. Organizations should identify affected installations and upgrade immediately; direct Satori users should update to **0.33.5**. No public exploitation or exploit code had been reported at the time of disclosure.
Sep 24, 2026