The vulnerability identified as CVE-2026-61461 affects langgenius's dify product prior to version 1.16.0-rc1. It is a SQL injection issue in the MyScale vector store backend, where the search_by_full_text method fails to properly sanitize or parameterize user-supplied search parameters. This improper neutralization of special elements in SQL commands enables attackers with limited privileges to inject malicious SQL statements, potentially compromising the confidentiality, integrity, and availability of data stored in the ClickHouse database backend.

Successful exploitation of this SQL injection vulnerability can allow attackers to execute arbitrary SQL queries on the ClickHouse database. This may result in unauthorized data disclosure, data modification, or deletion, impacting the confidentiality, integrity, and availability of the affected system's data. The CVSS 4.0 base score is 8.7, indicating a high impact with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using vulnerable versions or restrict access to the affected functionality to trusted users only. Monitor vendor communications for updates regarding patches or official mitigations.