Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-11824Stored XSS in langgenius/dify

Medium 5.8

In plain English

A medium-severity cross-site scripting in langgenius/dify from langgenius. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.0)5.8Medium

Exploit odds (30 days)0.5%top 58.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. The vulnerability arises because certain HTML tags like <input> and <form> are not disallowed, allowing an attacker to inject malicious HTML into the log via prompts. When an admin views the log containing the malicious HTML, the attacker could steal the admin's credentials or sensitive information. This issue is fixed in version 0.12.1.

Affected products (as reported)

Vendor	Product	Versions
langgenius	langgenius/dify	unspecified – before 0.12.1

Weakness: CWE-79 · Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References