Dify before 1.16.0-rc1 processes search parameters in the MyScale vector store backend without sanitization, permitting attackers to supply malicious input through the search_by_full_text method. The malicious input is directly interpolated into SQL statements that are executed on the underlying ClickHouse database, enabling arbitrary SQL injection. This flaw is a classic SQL injection weakness (CWE-89) that can compromise confidentiality and integrity of the data stored in the vector store.

The affected product is Dify by langgenius, all releases that use the MyScale vector store and expose the search_by_full_text API are vulnerable. Earlier versions such as 1.15.x remain impacted until a patch is applied.

The CVSS score of 8.7 indicates high severity, while the EPSS score shows a very low exploitation probability (<1%). The vulnerability is not listed in CISA’s KEV catalog. Attackers would likely exploit it remotely by sending crafted requests to the public API endpoint that invokes search_by_full_text; based on the description, the likely attack vector is remote HTTP exploitation. If successful, they could run arbitrary SQL against the ClickHouse database, potentially reading, modifying, or deleting data.