CVE-2026-26023
Client‑side DOM XSS in the web chat app of Dify when using echarts
概要
Client‑side DOM XSS in the web chat app of Dify when using echarts
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Dify is an open-source LLM app development platform. Prior to 1.13.0, a cross site scripting vulnerability has been found in the web application chat frontend when using echarts. User or llm inputs containing echarts containing a specific javascript payload will be executed. This vulnerability is fixed in 1.13.0.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com