Cross-site scripting in Dify - CVE-2026-26023
Published: July 27, 2026
Vulnerability identifier: #VU139799
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green
CVE-ID: CVE-2026-26023
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: LangGenius
Affected software:
Dify
Dify
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary JavaScript in the victim's browser.
The vulnerability exists due to cross-site scripting in the chat frontend markdown code block component when rendering user-supplied or LLM-supplied echarts content. A remote attacker can supply a specially crafted echarts payload to execute arbitrary JavaScript in the victim's browser.
If the payload is saved in chat history, the issue can be triggered as stored XSS for later viewers; otherwise, it is reflected DOM XSS for the current viewer.
How to mitigate CVE-2026-26023
Install security update from vendor's website.