CVE-2026-21866 — Dify - Stored XSS in chat
Dify is an open-source LLM app development platform. Prior to 1.11.2, Dify is vulnerable to a stored XSS issue when rendering Mermaid diagrams within chats. This occurs because …
Published: 2026-03-03 · CVSS: 5.1 · CVSS 4.0
Dify is an open-source LLM app development platform. Prior to 1.11.2, Dify is vulnerable to a stored XSS issue when rendering Mermaid diagrams within chats. This occurs because Dify’s default Mermaid configuration uses securityLevel: loose, which allows potentially unsafe content to execute. This vulnerability is fixed in 1.11.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7