Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestions search

All statuses
Filter by:
With package: hiddify-app

Found 2 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-21866
created 1 month, 3 weeks ago Activity log
  • Created suggestion 1 month, 3 weeks ago
Dify - Stored XSS in chat

Dify is an open-source LLM app development platform. Prior to 1.11.2, Dify is vulnerable to a stored XSS issue when rendering Mermaid diagrams within chats. This occurs because Dify’s default Mermaid configuration uses securityLevel: loose, which allows potentially unsafe content to execute. This vulnerability is fixed in 1.11.2.

Affected products

dify
  • ==< 1.11.2

Matching in nixpkgs

pkgs.hiddify-app

Multi-platform auto-proxy client, supporting Sing-box, X-ray, TUIC, Hysteria, Reality, Trojan, SSH etc

Package maintainers

Untriaged
Permalink CVE-2026-28288
created 1 month, 4 weeks ago Activity log
  • Created suggestion 1 month, 4 weeks ago
Dify has a user enumeration issue

Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.

Affected products

dify
  • ==< 1.9.0

Matching in nixpkgs

pkgs.hiddify-app

Multi-platform auto-proxy client, supporting Sing-box, X-ray, TUIC, Hysteria, Reality, Trojan, SSH etc

Package maintainers