CVE-2026-85021

Name of the Vulnerable Software and Affected Versions langgenius dify version 1.13.0

Description Cross site scripting occurs due to the manipulation of the redirect url argument within the router.replace() function located in the web/app/(shareLayout)/components/splash.tsx file of the Splash Layout component. This issue allows for remote exploitation.

Recommendations As a temporary workaround, restrict the use of the redirect url argument in the Splash Layout component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.