CVE-2026-26023: Dify

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Dify is an open-source LLM app development platform. Prior to 1.13.0, a cross site scripting vulnerability has been found in the web application chat frontend when using echarts. User or llm inputs containing echarts containing a specific javascript payload will be executed. This vulnerability is fixed in 1.13.0.

Affected products

• Dify Dify: up to and including 1.11.4

Published 2026-02-11. Last modified 2026-06-17.