The vulnerability allows an attacker to embed malicious code inside a Mermaid diagram that is rendered within chat messages. When an affected message is viewed, the injected code executes in the browser of any user who opens the chat, enabling session hijacking, data theft, or further exploitation. The weakness is classified as CWE-79, indicating insufficient input validation and output encoding for user-supplied content.

The flaw affects the Dify open-source LLM application, specifically versions older than 1.11.2. The attack surface is evident in the chat rendering component that accepts Mermaid diagram definitions. Users deploying Dify installations of these older releases are impacted.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score is below 1 %, showing very low but nonzero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is web-based interaction: an attacker can craft a Mermaid diagram, submit it via the chat interface, and have it stored by the system. When any user (including administrators) later views the chat, the malicious script runs within their browser context, compromising that user’s session or local environment. The impact is confined to victims’ browsers, but the stored nature can propagate the script to multiple users.