Executive brief
Dify, a popular open-source LLM application framework, contains a server-side template injection vulnerability in its Jinja2 code executor. An authenticated attacker can inject malicious templates through workflow nodes or APIs to achieve remote code execution and data exfiltration. The vulnerability exists because the code uses an unsandboxed Jinja2 template engine instead of applying proper sandboxing controls.
Technical details
The vulnerability is a server-side template injection (SSTI) in the Jinja2 handler component at api/core/helper/code_executor/jinja2/jinja2_transformer.py. The vulnerable code instantiates jinja2.Template() directly on user-controlled input rather than using jinja2.sandbox.SandboxedEnvironment(), which is correctly deployed elsewhere in the same codebase. An authenticated attacker can inject malicious Jinja2 templates via workflow code nodes or API endpoints to traverse Python object introspection (__class__, __mro__, __subclasses__) and achieve arbitrary code execution. The attack requires authentication but no additional preconditions; exploits are publicly available and weaponized in the wild.
Affected products
- LangGenius Dify up to 1.14.2
Timeline
- 2026-06-09: disclosed: Public disclosure via GitHub issue by CVE-Hunter-Leo
- 2026-08-03: advisory: CVE-2026-18632 published; vendor did not respond to early disclosure
- 2026-06-09: exploited: Proof-of-concept exploit released publicly