CVE-2026-21866: Dify - Stored XSS in chat
Dify is an open-source LLM app development platform. Prior to 1.11.2, Dify is vulnerable to a stored XSS issue when rendering Mermaid diagrams within chats. This occurs because Dify’s default Mermaid configuration uses securityLevel: loose, which allows potentially unsafe content to execute. This vulnerability is fixed in 1.11.2.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21866?
CVE-2026-21866 is classified as a moderate severity vulnerability due to the potential for stored XSS attacks.
How do I fix CVE-2026-21866?
To fix CVE-2026-21866, upgrade Dify to version 1.11.2 or later where the issue has been resolved.
What is stored XSS as referenced in CVE-2026-21866?
Stored XSS is a type of vulnerability where malicious scripts are injected into a web application and stored on the server, affecting all users accessing the data.
In which versions of Dify is CVE-2026-21866 found?
CVE-2026-21866 is found in Dify versions prior to 1.11.2.
How does CVE-2026-21866 impact users of Dify?
CVE-2026-21866 allows attackers to inject scripts through chat functionalities, potentially compromising user security.