Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-21866
5.4
MEDIUMCVSS v3
Published
March 3, 2026
Affected
5 projects
Assigned by
GitHub
Severity scale
010
Description
Dify is an open-source LLM app development platform. Prior to 1.11.2, Dify is vulnerable to a stored XSS issue when rendering Mermaid diagrams within chats. This occurs because Dify’s default Mermaid configuration uses securityLevel: loose, which allows potentially unsafe content to execute. This vulnerability is fixed in 1.11.2.
langgenius/dify
GitHubBuild Agentic workflows, RAG pipelines, with rich AI model and tool support on one collaborative workspace. Deploy on cloud, VPC, or self-hosted, so teams move from prototype to production without rebuilding the stack.
GitHubBuild Agentic workflows, RAG pipelines, with rich AI model and tool support on one collaborative workspace. Deploy on cloud, VPC, or self-hosted, so teams move from prototype to production without rebuilding the stack.< 1.11.2NVD
Crates.io
NPM
RubyGems