CVE-2024-11850

5.4 mediumEPSS 0.4%

Medium (5.4) in langgenius dify. EPSS 0.4% chance of exploitation in the next 30 days.

A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG content, which can execute arbitrary JavaScript code when viewed by an admin, potentially leading to credential theft.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-03-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

langgenius:dify

References

https://huntr.com/bounties/893da115-028d-4718-b586-a2b77897a470

Check your stack JSON