Dify CVE-2026-18632

Exploitation requires a valid low-privilege Dify account - the CVSS 4.0 PR:L metric confirms unauthenticated exploitation is not possible; any authenticated user credential satisfies this requirement. The attacker must have access to the Jinja2 template submission interface within Dify's code executor subsystem (api/core/helper/code_executor/jinja2/jinja2_transformer.py). The attack is network-accessible (AV:N) with low complexity (AC:L) and requires no user interaction. Limiting factors include: authentication is mandatory (no anonymous exploitation), and CVSS 4.0 impact metrics (VC:L/VI:L/VA:L) suggest sandboxing may constrain impact to information disclosure rather than full RCE - however, this sandboxing has not been independently verified. The specific Dify role or permission tier required to invoke Jinja2 template rendering is not specified in available data and should be verified against Dify's access control model.

The CVSS 4.0 base score of 5.3 (Medium) reflects a PR:L (low-privilege authentication required) network-accessible SSTI with impact capped at Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), with no subsequent-system impact (SC:N/SI:N/SA:N). This low-impact assessment is notable because Jinja2 SSTI vulnerabilities classically yield full remote code execution - the discrepancy suggests Dify may implement sandboxing on its Jinja2 execution environment, but this has not been confirmed by the vendor or any independent analysis. If that sandbox can be bypassed (a recurring finding in Jinja2 SSTI research), real-world impact would substantially exceed the scored metrics. The E:P modifier in the CVSS 4.0 vector confirms public proof-of-concept availability, elevating practical exploitation likelihood above what a 5.3 base score alone implies. No CISA KEV listing is present, indicating no confirmed mass exploitation at time of analysis, though the combination of network accessibility, low complexity, low privilege requirement, and a working POC represents a meaningful threat for organizations running exposed Dify instances. EPSS data was not provided; the absence of a vendor patch and lack of vendor engagement further increases organizational risk.

An authenticated Dify user with a standard low-privilege account accesses the Jinja2 code execution interface and submits a crafted template payload - such as one traversing Python class hierarchies to read environment variables or invoke subprocess calls - which the server renders without sanitization, returning sensitive data or executing attacker-controlled code. A public proof-of-concept targeting this specific CVE is available on GitHub, meaning exploitation requires minimal adaptation from the published exploit code. The attack requires no user interaction and is executable remotely over the network.