CVE-2024-11850

Stored XSS in langgenius/dify

State: Published
Severity: 6.8 Medium
Published: Mar 20, 2025
Updated: Mar 20, 2025
Reserved: Nov 26, 2024

Description

A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG content, which can execute arbitrary JavaScript code when viewed by an admin, potentially leading to credential theft.

Scores

CVSS	Score	Vector	Source
3.0	6.8 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N	@huntr_ai

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
langgenius/difylanggenius	latest and earlierAffected

References

https://huntr.com/bounties/893da115-028d-4718-b586-a2b77897a470

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.