CVE-2026-72777 is a server-side request forgery vulnerability affecting next-ai-draw-io through version 0.4.16. The flaw exists in the POST /api/parse-url endpoint where hostname validation is insufficient, relying only on string pattern matching without DNS resolution. Attackers can exploit this by providing hostnames that appear valid but resolve to internal IP addresses, allowing them to reach internal HTTP services and extract response data including cloud metadata. The vulnerability requires no authentication and has a CVSS 4.0 base score of 7.7 (high severity).

An unauthenticated attacker can exploit this SSRF vulnerability to access internal HTTP services that are normally inaccessible from outside the network. This can lead to unauthorized data disclosure, including sensitive cloud metadata, which may facilitate further attacks or information gathering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and implement network-level controls to limit outbound requests from the application server to internal services.