SB20260727381 - Cross-site scripting in Dify

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260727381

SB20260727381 - Cross-site scripting in Dify

Published: July 27, 2026

Security Bulletin ID SB20260727381
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: CVE-2026-26023)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary JavaScript in the victim's browser.

The vulnerability exists due to cross-site scripting in the chat frontend markdown code block component when rendering user-supplied or LLM-supplied echarts content. A remote attacker can supply a specially crafted echarts payload to execute arbitrary JavaScript in the victim's browser.

If the payload is saved in chat history, the issue can be triggered as stored XSS for later viewers; otherwise, it is reflected DOM XSS for the current viewer.


Remediation

Install update from vendor's website.

References