CVE-2026-85021: Cross Site Scripting in langgenius dify

CVE-2026-85021 is a cross-site scripting vulnerability found in langgenius dify version 1.13.0. The flaw resides in the router.replace function of the web/app/(shareLayout)/components/splash.tsx file, specifically in the Splash Layout component. Manipulation of the redirect_url argument can lead to XSS attacks. The vulnerability can be exploited remotely without privileges or user interaction beyond UI involvement. The vendor was contacted but did not respond, and no official remediation or patch is currently available. The vulnerability has been publicly disclosed, but no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or redirection to malicious sites. The attack requires user interaction (UI) but no privileges or authentication. The medium CVSS score reflects the moderate risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should consider implementing temporary mitigations such as input validation or sanitization on redirect_url parameters if possible. Monitor official vendor channels for updates.