VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 20, 2025· Updated Mar 20, 2025

Stored XSS in langgenius/dify

CVE-2024-11850

Description

A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG content, which can execute arbitrary JavaScript code when viewed by an admin, potentially leading to credential theft.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Langgenius/Difyllm-fuzzy
  • langgenius/langgenius/difyv5
    Range: unspecified

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.