CVE-2026-85021 in dify
Summary
by MITRE • 09/03/2026
A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirect_url causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified within langgenius dify version 1.13.0 represents a significant security flaw located specifically within the Splash Layout component, which is implemented in the file web/app/(shareLayout)/components/splash.tsx. The core of this issue lies in the improper handling of user-supplied input by the router.replace function when processing the redirect_url argument. This architectural weakness allows an attacker to inject malicious scripts into the application context through manipulated URL parameters or headers that are subsequently rendered without adequate sanitization or encoding. Because the Splash Layout is often one of the first components loaded during a session, particularly in shared link scenarios, this vulnerability provides a high-impact entry point for attackers aiming to compromise user sessions or steal sensitive data from individuals accessing these shared resources.
From a technical perspective, this flaw is classified as Cross-Site Scripting, commonly referred to by its acronym XSS. More specifically, it aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, which describes the failure to neutralize special characters in user input before rendering them in an HTML context. The router.replace function appears to take the redirect_url parameter and inject it directly into the browser's navigation or DOM manipulation logic without verifying that the content is safe. When a malicious payload such as JavaScript code is embedded within this URL, the browser interprets and executes it as part of the page script. This execution occurs in the context of the vulnerable application, granting the attacker the same privileges as legitimate users, including access to cookies, session tokens, and local storage data that are typically protected by Same-Origin Policy restrictions when not exploited via XSS.
The operational impact of this vulnerability is severe due to its remote exploitability and public disclosure status. Since the attack can be carried out remotely, an adversary does not need prior authentication or physical access to the target system. Instead, they simply need to lure a victim into clicking a crafted link that points to the vulnerable endpoint with the malicious redirect_url parameter embedded. Once clicked, the browser loads the Splash Layout component, triggers the router.replace function, and executes the injected script immediately upon page load. This can lead to session hijacking, where the attacker captures the user's authentication tokens to impersonate them within the application. It may also facilitate phishing attacks by displaying fake login forms or redirecting users to malicious sites that mimic legitimate interfaces. The fact that this exploit has been publicly disclosed and is known to be utilizable increases the risk landscape significantly, as automated scanners and threat actors are likely already targeting instances of dify running version 1.13.0.
The vendor's lack of response to early disclosure efforts exacerbates the situation for users who rely on langgenius dify for their workflows. Without an official patch or update from the development team, organizations must implement compensating controls to mitigate this risk until a fixed version is released. Immediate mitigation strategies should focus on input validation and output encoding at the application layer if custom modifications are possible, although given that this is a core component of the framework, upgrading remains the primary recommendation once available. In the interim, deploying Web Application Firewalls with rulesets capable of detecting and blocking XSS payloads in URL parameters can provide an additional layer of defense. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact by restricting the sources from which scripts are allowed to execute, thereby preventing many common XSS attack vectors even if the injection succeeds technically.
This vulnerability also maps to specific tactics within the MITRE ATT&CK framework for enterprise security. The initial access phase is represented by T1189: Drive-by Client Execution, where users are tricked into visiting a malicious site or clicking a link that triggers code execution in their browser. If the attacker aims to steal credentials, this falls under T1056: Input Capture, specifically keylogging or credential harvesting via injected forms. The persistence of session tokens obtained through XSS can also relate to T1539: Steal Web Session Cookie, allowing long-term unauthorized access. Understanding these mappings helps security teams prioritize remediation efforts based on the potential for data exfiltration and persistent compromise rather than just the technical existence of the flaw.
To ensure comprehensive protection, administrators should monitor network traffic for unusual patterns involving URL parameters that contain script tags or encoded JavaScript payloads targeting the splash layout endpoints. Regular vulnerability scanning with tools configured to detect XSS in dynamic web applications is essential to identify any instances where this specific vector might be triggered by other parts of the application logic. Furthermore, since langgenius dify is often used for AI-driven workflows involving sensitive data, the integrity of user sessions is critical. Organizations should consider implementing additional authentication checks or shortening session lifetimes to reduce the window of opportunity for attackers who have successfully exploited this vulnerability. Until a vendor-provided fix is available, treating version 1.13.0 as compromised in high-security environments and restricting access to trusted networks only are prudent operational measures.