CVE-2026-85022

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-85022

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85022.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-85022

Aliases

GHSA-7vhm-2r2w-hgg4

Published

2026-09-03T00:45:14Z

Modified

2026-09-05T03:48:41Z

Severity

2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting

Details

A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85022.json"
}

References

Affected packages

Git / github.com/langgenius/dify

Affected ranges

Type

GIT

Repo

https://github.com/langgenius/dify

Events

Introduced

c730fec1e422e907fed668291b2ea18c4c243644

Last Affected

c730fec1e422e907fed668291b2ea18c4c243644

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.13.0"
        },
        {
            "last_affected": "1.13.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.13.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85022.json"