Nixpkgs security tracker
Dismissed
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
4 packages
- speedify
- hiddify-app
- gomodifytags
- haskellPackages.swizzle-modify
- @LeSuisse dismissed
Client‑side DOM XSS in the web chat app of Dify when using echarts
Dify is an open-source LLM app development platform. Prior to 1.13.0, a cross site scripting vulnerability has been found in the web application chat frontend when using echarts. User or llm inputs containing echarts containing a specific javascript payload will be executed. This vulnerability is fixed in 1.13.0.
References
-
https://github.com/langgenius/dify/security/advisories/GHSA-qqjx-5h5w-x5vj x_refsource_CONFIRM
-
https://github.com/langgenius/dify/releases/tag/1.13.0 x_refsource_MISC
Affected products
dify
- ==< 1.13.0
Ignored packages (4)
pkgs.speedify
Use multiple internet connections in parallel
-
nixos-unstable 15.8.2-12611
- nixpkgs-unstable 15.8.2-12611
- nixos-unstable-small 15.8.2-12611
pkgs.hiddify-app
None
pkgs.haskellPackages.swizzle-modify
Swizzle modify functions