Medium severity5.4NVD Advisory· Published Mar 3, 2026· Updated Jun 17, 2026
CVE-2026-21866
CVE-2026-21866
Description
Dify is an open-source LLM app development platform. Prior to 1.11.2, Dify is vulnerable to a stored XSS issue when rendering Mermaid diagrams within chats. This occurs because Dify’s default Mermaid configuration uses securityLevel: loose, which allows potentially unsafe content to execute. This vulnerability is fixed in 1.11.2.
Affected products
3cpe:2.3:a:dify:dify:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:dify:dify:*:*:*:*:*:*:*:*range: <1.11.2
- (no CPE)range: < 1.11.2
Patches
Vulnerability mechanics
References
3- github.com/langgenius/dify/commit/ae17537470bba417a8971fff705dd82ecb043564nvdPatch
- github.com/langgenius/dify/pull/29811nvdIssue TrackingPatch
- github.com/langgenius/dify/security/advisories/GHSA-qpv6-75c2-75h4nvdExploitVendor Advisory
News mentions
0No linked articles in our index yet.