Description

A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirect_url causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-03T13:06:19.193Z",
  "pubdate": "2026-09-03T13:06:19.193Z",
  "executiveSummary": "A reflected cross-site scripting (XSS) vulnerability exists in Langgenius Dify version 1.13.0 within the Splash Layout component.\nThe vulnerability resides in the improper handling of the 'redirect_url' argument passed to the 'router.replace' function located in 'web/app/(shareLayout)/components/splash.tsx'.\nAn unauthenticated, remote attacker can exploit this flaw by crafting a malicious URL containing a payload designed to execute arbitrary JavaScript in the context of the user's browser session.\nThe primary risk implications include session hijacking, unauthorized actions performed on behalf of the victim, and potential exfiltration of sensitive information such as authentication tokens or session identifiers.\nThis vulnerability is classified as critical due to the ease of remote exploitation and the potential for complete compromise of the client-side environment.\nThe vendor was notified of this security flaw but failed to provide a responsive action or remediation plan.",
  "technicalDetails": "The root cause of this vulnerability is improper input sanitization and validation of the 'redirect_url' query parameter before it is passed to the 'router.replace' method within the Next.js router framework used in 'web/app/(shareLayout)/components/splash.tsx'.\nThe 'router.replace' function in this context is intended to handle navigation redirection. However, because the application does not validate that the 'redirect_url' parameter contains a safe, internal, or permitted origin, it allows for the injection of 'javascript:' URIs or other malicious schemes.\nExploitation is achieved via a reflected XSS attack flow. An attacker constructs a malicious hyperlink containing a crafted 'redirect_url' parameter, such as '?redirect_url=javascript:alert(document.domain)'. When a victim clicks this link, the 'splash.tsx' component retrieves the tainted input and invokes the router with the malicious payload.\nUpon execution by the 'router.replace' function, the browser interprets the 'javascript:' pseudo-protocol as a command rather than a navigation target, resulting in the execution of the injected script within the application's origin.\nThis vulnerability is fully exploitable remotely without the requirement for prior authentication or elevated system privileges, significantly increasing the attack surface.\nBecause the vulnerability exists in the shared layout component, any user accessing a public-facing Dify interface can be targeted. The impact is significant: successful execution allows the attacker to bypass the Same-Origin Policy (SOP), enabling the exfiltration of cookies, local storage data, and the ability to perform unauthorized requests to the backend API using the victim's session credentials.\nThe lack of adequate URL scheme validation in the application logic represents a failure to implement secure navigation practices. The issue is exacerbated by the reliance on client-side routing mechanisms without secondary server-side or front-end input filtering mechanisms to neutralize malicious payloads."
}