← Database

CVE-2026-21866

MEDIUM CVSS: 5.4 Published: 2026-03-03 Modified: 2026-06-17

Description

Dify is an open-source LLM app development platform. Prior to 1.11.2, Dify is vulnerable to a stored XSS issue when rendering Mermaid diagrams within chats. This occurs because Dify’s default Mermaid configuration uses securityLevel: loose, which allows potentially unsafe content to execute. This vulnerability is fixed in 1.11.2.

Affected Platforms

Dify Dify

Weakness Type

CWE-79

References