CVE-2026-6619

LOW

langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting

Title source: cna

Description

A vulnerability has been found in langgenius dify up to 1.13.3. Impacted is the function openInNewTab of the file web/app/components/base/image-uploader/image-preview.tsx of the component ImagePreview. The manipulation of the argument filename leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Signature, Permissions Required signature permissions-required

VDB-358254 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/358254/cti

Third Party Advisory third-party-advisory

Submit #792242 | LangGenius Dify v1.13.3 Cross-Site Scripting (CWE-79)

https://vuldb.com/submit/792242

Vdb Entry, Technical Description vdb-entry technical-description

VDB-358254 | langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting

https://vuldb.com/vuln/358254

Exploit exploit

https://gist.github.com/chenhouser2025/a8ac169dad5cf84811cf9c0505491ea8

Scores

CVSS v3 3.5

EPSS 0.0021

EPSS Percentile 10.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79 CWE-94

Status published

Products (4)

langgenius/dify 1.13.0

langgenius/dify 1.13.1

langgenius/dify 1.13.2

langgenius/dify 1.13.3

Published Apr 20, 2026

Tracked Since Apr 20, 2026