CVE-2026-26023
Client‑side DOM XSS in the web chat app of Dify when using echarts
Summary
Client‑side DOM XSS in the web chat app of Dify when using echarts
Original description
The description as published by the source.
Dify is an open-source LLM app development platform. Prior to 1.13.0, a cross site scripting vulnerability has been found in the web application chat frontend when using echarts. User or llm inputs containing echarts containing a specific javascript payload will be executed. This vulnerability is fixed in 1.13.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com