CVE-2026-21866

Description

Dify is an open-source LLM app development platform. Prior to 1.11.2, Dify is vulnerable to a stored XSS issue when rendering Mermaid diagrams within chats. This occurs because Dify’s default Mermaid configuration uses securityLevel: loose, which allows potentially unsafe content to execute. This vulnerability is fixed in 1.11.2.

PUBLISHED Reserved 2026-01-05 | Published 2026-03-03 | Updated 2026-03-04 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

References

github.com/...s/dify/security/advisories/GHSA-qpv6-75c2-75h4

github.com/langgenius/dify/pull/29811

github.com/...ommit/ae17537470bba417a8971fff705dd82ecb043564

cve.org (CVE-2026-21866)

nvd.nist.gov (CVE-2026-21866)

Download JSON