CVE-2026-21866: Dify

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Dify is an open-source LLM app development platform. Prior to 1.11.2, Dify is vulnerable to a stored XSS issue when rendering Mermaid diagrams within chats. This occurs because Dify’s default Mermaid configuration uses securityLevel: loose, which allows potentially unsafe content to execute. This vulnerability is fixed in 1.11.2.

Affected products

• Dify Dify: before 1.11.2 (fixed in 1.11.2)

Published 2026-03-03. Last modified 2026-06-17.