Stored XSS Vulnerability in Dify LLM App Development Platform

CVE-2026-21866

What is CVE-2026-21866?

Dify, an open-source platform for LLM app development, has a stored XSS vulnerability that impacts its ability to securely render Mermaid diagrams during chat interactions. This issue arises from the platform's default configuration of Mermaid, which employs a lenient security level, permitting the execution of potentially harmful content. The vulnerability has been addressed in version 1.11.2, and users are strongly recommended to update to this version to safeguard against exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References