CVE-2024-11850: Stored XSS in langgenius/dify
A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG content, which can execute arbitrary JavaScript code when viewed by an admin, potentially leading to credential theft.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11850?
CVE-2024-11850 is considered a high severity vulnerability due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2024-11850?
To fix CVE-2024-11850, ensure proper validation and sanitization of user input when using SVG markdown support in the chatbot feature.
What impact does CVE-2024-11850 have on users?
CVE-2024-11850 can lead to the execution of arbitrary scripts in the user's browser, compromising their data and session.
Who is affected by CVE-2024-11850?
CVE-2024-11850 affects users of the Langgenius dify application that utilizes the chatbot feature with SVG markdown support.
How can attackers exploit CVE-2024-11850?
Attackers can exploit CVE-2024-11850 by injecting malicious scripts into the chatbot, which are subsequently rendered in the browser of other users.