This vulnerability exists in the langgenius dify product, specifically in the openInNewTab function of the ImagePreview component's image-preview.tsx file. Improper handling of the filename argument allows an attacker to inject malicious scripts, resulting in cross-site scripting. The vulnerability is remotely exploitable and has been publicly disclosed, but no official fix or remediation level has been provided by the vendor. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low attack complexity, and requiring some user interaction.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. However, the impact is limited by the requirement for some user interaction and the absence of privilege escalation or confidentiality/integrity violations. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider applying manual input validation or sanitization on the filename parameter as a temporary mitigation. Avoid exposing the vulnerable component to untrusted inputs until an official patch is available.