A flaw has been found in langgenius dify up to 1.13.3.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 20, 2026 · NIST NVD

   Detected

   A flaw has been found in langgenius dify up to 1.13.3. This issue affects the function parse_openai_plugin_json_to_tool_bundle of the file api/core/tools/utils/parser.py of the component ApiBasedToolSchemaParser. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The vendor was c

2. Jun 17, 2026 · NIST NVD

   Updated

   A flaw has been found in langgenius dify up to 1.13.3. This issue affects the function parse_openai_plugin_json_to_tool_bundle of the file api/core/tools/utils/parser.py of the component ApiBasedToolSchemaParser. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The vendor was c

Sources

• CVE.orgVulnerability recordCVE-2026-6618

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-6618

  A flaw has been found in langgenius dify up to 1.13.3. This issue affects the function parse_openai_plugin_json_to_tool_bundle of the file api/core/tools/utils/parser.py of the component ApiBasedToolSchemaParser. Executing a manipulation of the argument url can lead to server-sid

  nvd.nist.gov

References

• Reference · gist.github.com
• Reference · vuldb.com
• Reference · vuldb.com
• Reference · vuldb.com