Langgenius Dify vulnerabilities

CVE-2026-6618 [MEDIUM] CWE-918 CVE-2026-6618: A flaw has been found in langgenius dify up to 1.13.3. This issue affects the function parse_openai_ A flaw has been found in langgenius dify up to 1.13.3. This issue affects the function parse_openai_plugin_json_to_tool_bundle of the file api/core/tools/utils/parser.py of the component ApiBasedToolSchemaParser. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be launched remotely. The exploit has b

CVE-2024-12775 [MEDIUM] CWE-918 CVE-2024-12775: langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the te langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API `POST /console/api/workspaces/current/tool-provider/api/test/pre`. Attackers can set the `url` in the `servers` dictionary in OpenAI's schema with arbitrary URL targets, allowing them

CVE-2026-105761 [HIGH] CWE-639 CVE-2026-105761: Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/< Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/ /server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to the requested application and tenant. An authentica

CVE-2025-67732 [MEDIUM] CWE-200 CVE-2025-67732: Dify is an open-source LLM app development platform. Prior to version 1.11.0, the API key is exposed Dify is an open-source LLM app development platform. Prior to version 1.11.0, the API key is exposed in plaintext to the frontend, allowing non-administrator users to view and reuse it. This can lead to unauthorized access to third-party services, potentially consuming limited quotas. Version 1.11.0 fixes the issue.

CVE-2025-0184 [MEDIUM] CWE-918 CVE-2025-0184: A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests' module instead of the 'ssrf_proxy', leading to an SS

CVE-2025-32795 [MEDIUM] CWE-284 CVE-2025-32795: Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was id Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly granted permissions to edit APP names, descriptions and icons. This access control flaw allows non-admin users to modify app details, despite being restricted from viewing apps, which poses a secu

CVE-2025-32796 [MEDIUM] CWE-284 CVE-2025-32796: Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was id Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disable apps through the API, even though the web UI button for this action is disabled and normal users are not permitted to make such changes. This access control flaw allows non-admin users to m

CVE-2024-11824 [HIGH] CWE-79 CVE-2024-11824: A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specific A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. The vulnerability arises because certain HTML tags like and are not disallowed, allowing an attacker to inject malicious HTML into the log via prompts. When an admin views the log containing the malicious HTML, the att

CVE-2025-58747 [MEDIUM] CWE-79 CVE-2025-58747: Dify is an LLM application development platform. In Dify versions through 1.9.1, the MCP OAuth compo Dify is an LLM application development platform. In Dify versions through 1.9.1, the MCP OAuth component is vulnerable to cross-site scripting when a victim connects to an attacker-controlled remote MCP server. The vulnerability exists in the OAuth flow implementation where the authorization_url provided by a remote MCP server is directly passed to w

CVE-2026-42138 [MEDIUM] CWE-79 CVE-2026-42138: Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS. The method POST /v1/files/upload, which requires authentication through the application API, is also vulnerable. This issue has been patched in version 1.13.1.

CVE-2026-18266 [MEDIUM] CWE-601 CVE-2026-18266: Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability. This vulnerability allows remote at Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Dify. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the OAuth

CVE-2026-26023 [MEDIUM] CWE-79 CVE-2026-26023: Dify is an open-source LLM app development platform. Prior to 1.13.0, a cross site scripting vulnera Dify is an open-source LLM app development platform. Prior to 1.13.0, a cross site scripting vulnerability has been found in the web application chat frontend when using echarts. User or llm inputs containing echarts containing a specific javascript payload will be executed. This vulnerability is fixed in 1.13.0.

CVE-2025-43854 [MEDIUM] CWE-1021 CVE-2025-43854: DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerab DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially co

CVE-2025-3467 [MEDIUM] CWE-79 CVE-2025-3467: An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firef An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This vulnerability allows an attacker to obtain the administrator's token by sending a payload in the published chat. When the administrator views the conversation content through the monitoring/log function using Firefox, the XSS vulnerabil

CVE-2026-21866 [MEDIUM] CWE-79 CVE-2026-21866: Dify is an open-source LLM app development platform. Prior to 1.11.2, Dify is vulnerable to a stored Dify is an open-source LLM app development platform. Prior to 1.11.2, Dify is vulnerable to a stored XSS issue when rendering Mermaid diagrams within chats. This occurs because Dify’s default Mermaid configuration uses securityLevel: loose, which allows potentially unsafe content to execute. This vulnerability is fixed in 1.11.2.

CVE-2026-85021 [MEDIUM] CWE-79 CVE-2026-85021: A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirect_url causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed

CVE-2025-49149 [MEDIUM] CWE-79 CVE-2025-49149: Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filteri Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting (XSS) attack when a user browses these web pages. At time of posting, there is no

CVE-2024-11850 [MEDIUM] CWE-79 CVE-2024-11850: A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify. T A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG content, which can execute arbitrary JavaScript code

CVE-2024-11821 [MEDIUM] CWE-250 CVE-2024-11821: A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability all A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint /console/api/apps/{chatbot-id}/model-config, allowing unaut

CVE-2025-32790 [MEDIUM] CWE-284 CVE-2025-32790: Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability wa Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A workaround for this vulnerability involves updating the access control