CVE-2026-26023
Client‑side DOM XSS in the web chat app of Dify when using echarts
Résumé
Client‑side DOM XSS in the web chat app of Dify when using echarts
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Dify is an open-source LLM app development platform. Prior to 1.13.0, a cross site scripting vulnerability has been found in the web application chat frontend when using echarts. User or llm inputs containing echarts containing a specific javascript payload will be executed. This vulnerability is fixed in 1.13.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com