CVE-2026-85022

A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/shareLayout/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirecturl leads to cross...

CVE-2026-85022 langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting

A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/shareLayout/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirecturl leads to cross...

CVE-2026-85022

A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/shareLayout/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirecturl leads to cross...

EUVD-2026-70298

A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/shareLayout/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirecturl leads to cross...

CVE-2026-85022

A cross-site scripting (XSS) vulnerability affects the WebApp Sign-In component of langgenius dify 1.13.0 , specifically in the router.replace function within web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx. Manipulating the redirect_url argument enables remote attackers...

CVE-2026-85021

A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/shareLayout/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirecturl causes cross site scripting. The attack is possible to be carried o...

CVE-2026-85021

langgenius/dify version 1.13.0 is affected by a cross-site scripting (XSS) vulnerability in the Splash Layout component, specifically in the router.replace function within web/app/(shareLayout)/components/splash.tsx. The root cause is improper handling of the redirect_url argument, allowing remot...

CVE-2026-85022: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/shareLayout/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirecturl leads to cross...

CVE-2026-85021: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/shareLayout/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirecturl causes cross site scripting. The attack is possible to be carried o...

PT-2026-84900

A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/shareLayout/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirect url causes cross site scripting. The attack is possible to be carried...

CVE-2026-18632

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/codeexecutor/jinja2/jinja2transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used i...

CVE-2026-18632 langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/codeexecutor/jinja2/jinja2transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used i...

EUVD-2026-52412

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/codeexecutor/jinja2/jinja2transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used i...

CVE-2026-18632

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/codeexecutor/jinja2/jinja2transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used i...

CVE-2026-18632

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/codeexecutor/jinja2/jinja2transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used i...

CVE-2026-18632 langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/codeexecutor/jinja2/jinja2transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used i...

CVE-2026-18632

CVE-2026-18632 affects langgenius dify up to 1.14.2, specifically the Jinja2 Handler’s jinja2_transformer.py (api/core/helper/code_executor/jinja2/jinja2_transformer.py) and its use of jinja2.Template. The vulnerability arises from improper neutralization of special elements used in the template ...

PT-2026-67484

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/code executor/jinja2/jinja2 transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used...

CVE-2026-18632: Improper Neutralization of Special Elements Used in a Template Engine

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/codeexecutor/jinja2/jinja2transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used i...

LangGenius, Inc. Dify has an SSRF vulnerability

Dify is an open-source LLM application development platform. LangGenius, Inc. Dify has an SSRF vulnerability, which allows attackers to obtain sensitive information...