Unrated severityNVD Advisory· Published Mar 3, 2026· Updated Mar 4, 2026
Dify - Stored XSS in chat
CVE-2026-21866
Description
Dify is an open-source LLM app development platform. Prior to 1.11.2, Dify is vulnerable to a stored XSS issue when rendering Mermaid diagrams within chats. This occurs because Dify’s default Mermaid configuration uses securityLevel: loose, which allows potentially unsafe content to execute. This vulnerability is fixed in 1.11.2.
Affected products
2<1.11.2+ 1 more
- (no CPE)range: <1.11.2
- (no CPE)range: < 1.11.2
Patches
Vulnerability mechanics
References
3- github.com/langgenius/dify/commit/ae17537470bba417a8971fff705dd82ecb043564mitrex_refsource_MISC
- github.com/langgenius/dify/pull/29811mitrex_refsource_MISC
- github.com/langgenius/dify/security/advisories/GHSA-qpv6-75c2-75h4mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.