CVE-2026-26023: 
Dify vulnerability analysis and mitigation

CVE-2026-26023 is a client-side DOM-based Cross-Site Scripting (XSS) vulnerability in Dify, an open-source LLM application development platform. The flaw exists in the web application chat frontend's echarts rendering component, where user or LLM-supplied inputs containing a crafted JavaScript payload are executed in the victim's browser. All Dify versions up to and including v1.11.4 are affected; the vulnerability was disclosed on February 11, 2026, and fixed in version 1.13.0. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of script-related input during web page generation (CWE-79 / CWE-80). In web/app/components/base/markdown-blocks/code-block.tsx, the application used JavaScript's new Function() constructor to evaluate echarts configuration blocks that failed JSON parsing — effectively executing arbitrary code supplied in chat messages as an Immediately Invoked Function Expression (IIFE). The attack vector is network-based and requires passive user interaction (a victim viewing a chat message containing the payload). The PoC payload published in the security advisory demonstrates the issue: an echarts code block embedding an arrow function (e.g., _x: (() => { alert('Hello'); return 1; })()) triggers execution upon rendering (GitHub Advisory, Patch Commit).

Successful exploitation grants an attacker full arbitrary JavaScript execution in the victim's browser within the context of the Dify web application. This enables session/account takeover via cookie or token theft, exfiltration of data visible in the DOM (chat history, files, secrets), and unauthorized actions via in-app APIs using the victim's authenticated session. If the malicious payload is persisted in chat history, it becomes stored XSS and will execute for every subsequent viewer of that conversation; otherwise it functions as reflected DOM XSS for the current session (GitHub Advisory).

A proof-of-concept payload is publicly documented in the GitHub Security Advisory, consisting of a manually crafted echarts code block that can be entered into any Dify chat interface. No automated exploit kit or in-the-wild exploitation has been confirmed at this time. The EPSS score is approximately 0.045% (low probability of near-term exploitation). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Qualys has published a detection (ID: 530942) for this CVE (GitHub Advisory, Feedly).

1. Identify a target Dify instance: Locate a Dify deployment running version ≤ 1.11.4 with an accessible chat application frontend.
2. Craft the echarts XSS payload: Prepare a chat message containing a fenced code block tagged as echarts with an embedded JavaScript IIFE, for example:

   ```echarts
   ({
     title: { text: 'Test XSS' },
     series: [],
     _x: (() => { /* malicious JS here, e.g., exfiltrate document.cookie */ return 1; })()
   })
   ```

3. Deliver the payload: Submit the crafted message in the chat interface — either directly as a user, or by manipulating an LLM to output the payload as part of its response.
4. Trigger execution: When the victim (or any subsequent viewer of the chat history) loads the message, the frontend's code-block.tsx component attempts to parse the echarts block; failing JSON parsing, it falls back to new Function(), which executes the embedded IIFE.
5. Achieve objective: The attacker's JavaScript runs in the victim's browser session, enabling cookie/token theft, DOM data exfiltration, or API calls on behalf of the victim (GitHub Advisory, Patch Commit).

• Network: Unexpected outbound HTTP requests from a user's browser to attacker-controlled domains originating from the Dify web application origin; unusual API calls (e.g., session token exfiltration via fetch or XMLHttpRequest) in browser network logs.
• Logs: Chat messages in Dify's conversation history containing fenced code blocks with the echarts language tag and JavaScript function syntax (e.g., arrow functions, alert, fetch, document.cookie) embedded in the chart options object.
• Browser Console: JavaScript errors or unexpected alert dialogs appearing when viewing specific chat conversations; console logs showing execution of code originating from echarts rendering components.
• File System / Application Data: Stored chat history entries containing echarts payloads with IIFE patterns such as (() => { ... })() or references to document.cookie, localStorage, or external URLs (GitHub Advisory).

Upgrade Dify to version 1.13.0 or later, which removes the dangerous new Function() call from echarts parsing and replaces it with strict JSON-only parsing — non-JSON chart configurations now return a parse error instead of executing code (Dify Release 1.13.0, Patch Commit). If immediate patching is not feasible, restrict access to the Dify chat application to trusted users only, and implement a strict Content Security Policy (CSP) header that disallows unsafe-eval and inline script execution to reduce the attack surface. Monitor chat inputs and browser console logs for suspicious JavaScript patterns in echarts blocks (GitHub Advisory).

The vulnerability was reported by security researcher veganmosfet and disclosed via GitHub's coordinated security advisory process on February 11, 2026. Qualys added detection coverage (ID: 530942) shortly after disclosure. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time (GitHub Advisory).