LangGenius Dify 0.9.2 for Node.js
Approved changes feed: RSS · Atom
cpe:2.3:a:langgenius:dify:0.9.2:*:*:*:*:node.js:*:*
part: a version: 0.9.2 update: *
| Vendor | Langgenius (a11e3e82-2124-53e0-86c4-d486ffc06315) |
|---|---|
| Product | Dify (06d833dc-7fe4-596f-bc9e-8cb6d713e080) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/langgenius/dify |
purl2cpe | 2026-06-01 10:17:28.144660 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-11850 |
vulnerable | 2026-06-08 06:23:50.524604 |
Stored XSS in langgenius/dify
MEDIUM (6.8)
A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG content, which can execute arbitrary JavaScript code when viewed by an admin, potentially leading to credential theft.
Published: 2025-03-20T10:10:55.421Z
Updated: 2025-03-20T18:14:58.033Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.