VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Mar 20, 2025· Updated Jun 17, 2026

CVE-2024-11850

CVE-2024-11850

Description

A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG content, which can execute arbitrary JavaScript code when viewed by an admin, potentially leading to credential theft.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Langgenius/Dify2 versions
    cpe:2.3:a:langgenius:dify:0.9.2:*:*:*:*:node.js:*:*+ 1 more
    • cpe:2.3:a:langgenius:dify:0.9.2:*:*:*:*:node.js:*:*
    • (no CPE)range: latest
  • langgenius/langgenius/difyv5
    Range: unspecified

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.