CVE-2024-11850

CVE-2024-11850 describes a stored XSS vulnerability in the latest version of langgenius/dify, caused by improper validation/sanitization of user input in SVG markdown support within the chatbot feature. An attacker can inject malicious SVG content that executes JavaScript when viewed by an admin,...

CVE-2024-11850 Stored XSS in langgenius/dify

A stored cross-site scripting XSS vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG...