CVE-2026-18632

Name of the Vulnerable Software and Affected Versions langgenius dify versions prior to 1.14.3

Description A security flaw exists in the Jinja2 Handler component within the file api/core/helper/code executor/jinja2/jinja2 transformer.py. The issue occurs in the jinja2.Template() function, where improper neutralization of special elements used in the template engine allows for remote attacks.

Recommendations As a temporary workaround, consider restricting the use of the jinja2.Template() function in the api/core/helper/code executor/jinja2/jinja2 transformer.py file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.