CVE-2026-21866: 
Dify vulnerability analysis and mitigation

CVE-2026-21866 is a stored Cross-Site Scripting (XSS) vulnerability in Dify, an open-source LLM application development platform, affecting all versions prior to 1.11.2. The flaw exists in the Mermaid diagram rendering component within chat conversations, where the default Mermaid configuration used securityLevel: loose, enabling execution of unsafe content. It was published on March 3, 2026, and fixed in version 1.11.2. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically arising from Dify's Mermaid diagram renderer being configured with securityLevel: 'loose' in web/app/components/base/mermaid/index.tsx. This setting enables Mermaid's click directive feature, which allows attaching JavaScript callbacks or arbitrary URLs (including javascript: protocol URIs) to diagram nodes. An authenticated attacker with low privileges can craft a malicious Mermaid diagram payload — for example, a flowchart with a click directive using javascript:alert(location.href) — embed it in a chat message, and have it execute in the browser of any user who views or clicks the rendered diagram. A public proof-of-concept payload is included in the security advisory (GitHub Advisory, Patch PR).

Successful exploitation allows an authenticated attacker to persistently inject malicious scripts into chat conversations that execute in the browsers of other users who view the shared chat. This can result in session hijacking, credential theft, unauthorized access to sensitive information within the Dify application, and potential lateral movement within the platform's user context. The stored nature of the XSS means a single malicious message can affect multiple victims over time without further attacker interaction (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub security advisory, demonstrating the attack with a simple Mermaid flowchart payload. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.044% (0.000440), indicating low current exploitation probability. Exploitation requires an authenticated attacker with low privileges and passive user interaction (a victim viewing or clicking the diagram) (GitHub Advisory).

1. Authenticate: Log in to a Dify instance running a version prior to 1.11.2 with any low-privilege user account.
2. Create or access a ChatBot: Navigate to a Dify ChatBot or chat conversation where Mermaid diagram rendering is enabled.
3. Craft the malicious payload: Compose a Mermaid diagram with a click directive using the javascript: protocol, for example:

flowchart TD
  A["Click"]
  click A href "javascript:alert(document.cookie)"

4. Send the message: Submit the crafted diagram as a chat message. Dify renders it as an interactive Mermaid diagram stored in the conversation.
5. Share or wait for victim interaction: Share the chat link with a target user, or wait for another user to view the conversation. When the victim clicks the rendered diagram node, the JavaScript payload executes in their browser context.
6. Achieve objective: The executed script can exfiltrate session cookies, perform actions on behalf of the victim, or redirect to attacker-controlled infrastructure (GitHub Advisory, Patch PR).

• Network: Outbound requests from a victim's browser to unexpected external domains shortly after viewing a Dify chat containing Mermaid diagrams; unusual POST requests to attacker-controlled endpoints carrying session tokens or cookie data.
• Logs: Dify application logs showing chat messages containing Mermaid code with click directives referencing javascript: URIs or external URLs; access logs showing the same chat conversation being accessed by multiple users.
• File System / Application Data: Chat message content in the Dify database containing Mermaid diagram syntax with click directives (e.g., lines matching click <nodeId> href "javascript:..." or click <nodeId> call <callback>).
• Browser: Unexpected JavaScript execution or alert dialogs when interacting with Mermaid diagrams in Dify chat; browser developer tools showing script execution originating from rendered SVG content (GitHub Advisory).

Upgrade Dify to version 1.11.2 or later, which addresses the vulnerability by changing the Mermaid securityLevel from 'loose' to 'strict' in both the initial and dynamic configurations, introducing a sanitizeMermaidCode utility that strips click directives and %%{init:...}%% override blocks, and applying DOMPurify sanitization to the final SVG output. No official configuration-based workaround is available for unpatched versions; the recommended action is immediate upgrade. The fix is available in commit ae17537470bba417a8971fff705dd82ecb043564 (Patch Commit, Patch PR).

The vulnerability was reported by security researcher cataliniovita-snyk and disclosed via GitHub's security advisory program. The fix was reviewed and merged by Dify maintainers with input from Gemini Code Assist and GitHub Copilot AI reviewers, who noted additional edge cases in the sanitization logic (e.g., tab-separated click directives and unclosed %%{ blocks). No significant broader media coverage or notable external researcher commentary beyond the advisory and PR discussion has been identified (GitHub Advisory, Patch PR).