CVE-2026-21866

Dify is an open-source LLM app development platform. Prior to 1.11.2, Dify is vulnerable to a stored XSS issue when rendering Mermaid diagrams within chats. This occurs because Dify’s default Mermaid configuration uses securityLevel: loose, which allows potentially unsafe content to execute. This vulnerability is fixed in 1.11.2.

• CWE-79

• https://github.com/langgenius/dify/commit/ae17537470bba417a8971fff705dd82ecb043564Patch
• https://github.com/langgenius/dify/pull/29811Issue Tracking, Patch
• https://github.com/langgenius/dify/security/advisories/GHSA-qpv6-75c2-75h4Exploit, Vendor Advisory

Published

Mar 3, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21860Werkzeug is a comprehensive WSGI web application library. Pr…5.3
• CVE-2026-21861baserCMS is a website development framework. Prior to versio…7.2
• CVE-2026-21862RustFS is a distributed object storage system built in Rust.…7.5
• CVE-2026-21863Valkey is a distributed key-value database. Prior to version…7.5
• CVE-2026-21864Valkey-Bloom is a Rust based Valkey module which brings a Bl…7.5
• CVE-2026-21865Discourse is an open source discussion platform. In versions…6.5
• CVE-2026-21867Rejected reason: Reason: This candidate was issued in error.
• CVE-2026-21868Flag Forge is a Capture The Flag (CTF) platform. Versions 2.…7.5
• CVE-2026-21869llama.cpp is an inference of several LLM models in C/C++. In…9.8
• CVE-2026-2187A vulnerability was found in Tenda RX3 16.03.13.11. The affe…8.8
• CVE-2026-21870BACnet Protocol Stack library provides a BACnet application …5.5
• CVE-2026-21871NiceGUI is a Python-based UI framework. From versions 2.13.0…6.1