CVE-2024-11850 json
Stored XSS in langgenius/dify
published 2025-03-20 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-7037
- cvss
- 6.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG content, which can execute arbitrary JavaScript code when viewed by an admin, potentially leading to credential theft.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/893da115-028d-4718-b586-a2b77897a470 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 6.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected products
- langgenius langgenius/dify
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
huntr.com
/bounties/893da115-028d-4718-b586-a2b77897a470
exploit, third-party-advisory
Sources
- CVE List CVE-2024-11850
- NVD CVE-2024-11850
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.