CVE-2024-11850mediumCWE-79

CVE-2024-11850: medium-severity vulnerability in langgenius/dify

Stored XSS in langgenius/dify

Published

Follow this CVE+ Monitor langgenius/dify

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 0.4%
A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG content, which can execute arbitrary JavaScript code when viewed by an admin, potentially leading to credential theft.
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Affected products
langgenius · langgenius/dify
Related CVEs — langgenius/dify

In the same product, most dangerous first.

CVE-2025-0185HIGHPandas Query Injection in langgenius/difyEPSS 1.1%CVE-2024-10252HIGHCode Injection in langgenius/difyEPSS 0.8%CVE-2025-3466CRITICALUnsanitized Input in langgenius/difyEPSS 0.8%CVE-2025-11750MEDIUMUser Enumeration via Distinct Error Messages in langgenius/dify-webEPSS 0.7%CVE-2024-12039HIGHImproper Restriction of Excessive Authentication Attempts in langgenius/difyEPSS 0.7%CVE-2024-12776HIGHAuthentication Bypass in langgenius/difyEPSS 0.7%