PT-2026-57262 · Langgenius · Dify

Yu Sun · Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-61461

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search by full text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-61461

Produtos afetados

Dify

Referências · 6

• 🔥 https://github.com/langgenius/dify/issues/38281 · Exploit
• https://github.com/langgenius/dify/commit/d9884efaeea8322706e24c560d2c17e5bf3fab5f · Correção
• https://github.com/langgenius/dify/pull/38295 · Nota
• https://github.com/langgenius/dify/releases/tag/1.16.0-rc1 · Nota
• https://vulncheck.com/advisories/dify-rc1-sql-injection-via-myscale-vector-store-search-by-full-text · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-61461 · Nota de Segurança