Dismissed
by @LeSuisse Activity log
- Created automatic suggestion
-
@LeSuisse
removed
4 packages
- speedify
- hiddify-app
- gomodifytags
- haskellPackages.swizzle-modify
- @LeSuisse dismissed
Client‑side DOM XSS in the web chat app of Dify when using echarts
Dify is an open-source LLM app development platform. Prior to 1.13.0, a cross site scripting vulnerability has been found in the web application chat frontend when using echarts. User or llm inputs containing echarts containing a specific javascript payload will be executed. This vulnerability is fixed in 1.13.0.
References
- https://github.com/langgenius/dify/security/advisories/GHSA-qqjx-5h5w-x5vj x_refsource_CONFIRM
- https://github.com/langgenius/dify/commit/378a1d7d08bd0ac5c75eaadc075a0f35211fcb8e x_refsource_MISC
- https://github.com/langgenius/dify/releases/tag/1.13.0 x_refsource_MISC
- https://github.com/langgenius/dify/security/advisories/GHSA-qqjx-5h5w-x5vj x_refsource_CONFIRM
- https://github.com/langgenius/dify/commit/378a1d7d08bd0ac5c75eaadc075a0f35211fcb8e x_refsource_MISC
- https://github.com/langgenius/dify/releases/tag/1.13.0 x_refsource_MISC
Affected products
dify
- ==< 1.13.0