PT-2026-57262 · Langgenius · Dify

Yu Sun · Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-61461

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search by full text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-61461

Affected Products

Dify

References · 6

• 🔥 https://github.com/langgenius/dify/issues/38281 · Exploit
• https://github.com/langgenius/dify/commit/d9884efaeea8322706e24c560d2c17e5bf3fab5f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-61461 · Security Note
• https://github.com/langgenius/dify/pull/38295 · Note
• https://github.com/langgenius/dify/releases/tag/1.16.0-rc1 · Note
• https://vulncheck.com/advisories/dify-rc1-sql-injection-via-myscale-vector-store-search-by-full-text · Note