Is there a public PoC exploit available for CVE-2026-18632?

Yes, a public proof-of-concept exploit is available for CVE-2026-18632. Prioritise patching immediately. EPSS: 0.4%.

Dify CVE-2026-18632

Q: What is the CVSS score of CVE-2026-18632?

CVE-2026-18632 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-52412 LOW

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-08-03 VulDB

GHSA-9qv6-q72p-wgw8

Information Disclosure Ssti Dify Langgenius

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

PR:L reflects mandatory authenticated access; S:U aligns with CVSS 4.0 SC:N/SI:N/SA:N (no scope change); C/I/A:L mirrors the 4.0 VC/VI/VA:L sandboxed-impact assessment.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 03, 2026 - 20:22 NVD

MEDIUM LOW

CVSS changed

Aug 03, 2026 - 20:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 03, 2026 - 20:08 vuln.today

CVE Published

Aug 03, 2026 - 19:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/code_executor/jinja2/jinja2_transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used in a template engine. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side template injection (SSTI) in Dify's Jinja2 Handler (versions ≤1.14.2) allows remote, low-privileged authenticated attackers to inject malicious Jinja2 template expressions through the code execution subsystem, resulting in information disclosure and potential further impact. A public proof-of-concept exploit is available on GitHub, materially lowering the bar for exploitation. The vendor did not respond to responsible disclosure, meaning no patch has been released and no official mitigation guidance exists.

Technical ContextAI

CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) describes server-side template injection, where user-controlled input is passed unsanitized into a Jinja2 Template() constructor or render call. The vulnerable component in Dify - an open-source LLM application development platform - is the Jinja2 transformer at api/core/helper/code_executor/jinja2/jinja2_transformer.py, which is responsible for rendering Jinja2 templates within the platform's code execution pipeline. In Python environments, Jinja2 SSTI is particularly severe because template context access can expose Python builtins, object class hierarchies, and, absent effective sandboxing, yield arbitrary code execution via __class__.__mro__ traversal. The CPE cpe:2.3:a:langgenius:dify:*:*:*:*:*:*:*:* confirms all Dify releases through version 1.14.2 are affected, spanning both self-hosted and container-based deployments.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to responsible disclosure and no patched version has been confirmed. The most effective compensating control is to disable the Jinja2 code executor feature in Dify's configuration if it is not operationally required, eliminating the attack surface entirely. If the feature must remain enabled, restrict access to it to the minimum set of trusted users by tightening Dify role assignments, reducing the pool of accounts that can submit or modify Jinja2 templates. Deploying a WAF rule to detect common Jinja2 SSTI payloads (e.g., expressions containing double braces, __class__, __mro__, config, or cycler) can reduce automated exploitation, though signature-based rules carry bypass risk and should be treated as a secondary control. Organizations should monitor the VulDB advisory at https://vuldb.com/vuln/385555 and the POC reference at https://github.com/CVE-Hunter-Leo/CVE/issues/14 for any patch releases or updated guidance.