CVE-2024-11850: falha de média gravidade em langgenius/dify
Stored XSS in langgenius/dify
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.4%
A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG content, which can execute arbitrary JavaScript code when viewed by an admin, potentially leading to credential theft.
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Produtos afetados
langgenius · langgenius/difyCVEs relacionadas — langgenius/dify
No mesmo produto, das mais perigosas para as menos.
CVE-2025-0185HIGHPandas Query Injection in langgenius/difyEPSS 1.1%CVE-2024-10252HIGHCode Injection in langgenius/difyEPSS 0.8%CVE-2025-3466CRITICALUnsanitized Input in langgenius/difyEPSS 0.8%CVE-2025-11750MEDIUMUser Enumeration via Distinct Error Messages in langgenius/dify-webEPSS 0.7%CVE-2024-12039HIGHImproper Restriction of Excessive Authentication Attempts in langgenius/difyEPSS 0.7%CVE-2024-12776HIGHAuthentication Bypass in langgenius/difyEPSS 0.7%