CVE-2026-61461CWE-89sql-injection

CVE-2026-61461

High · published July 10, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00497 · 41.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-07-10T23:17Z
Affected products (1)
ProductVersionsFixed in
dify/dify< 1.16.01.16.0
References (5)
https://github.com/langgenius/dify/commit/d9884efaeea8322706e24c560d2c17e5bf3fab5f · [email protected]https://github.com/langgenius/dify/issues/38281 · [email protected]https://github.com/langgenius/dify/pull/38295 · [email protected]https://github.com/langgenius/dify/releases/tag/1.16.0-rc1 · [email protected]https://www.vulncheck.com/advisories/dify-rc1-sql-injection-via-myscale-vector-store-search-by-full-text · [email protected]
EPSS history
Timeline
  • 10 JUL 18:10Z
    Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text
    cvelistv5