Description
Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| langgenius | dify | < 1.16.0-rc1 | 1.16.0-rc1 |
References
- dify 1.16.0-rc1 Release Notes release-notes
- Researcher Disclosure technical-description exploit issue-tracking
- Pull Request issue-tracking patch
- Patch Commit patch
- https://www.vulncheck.com/advisories/dify-rc1-sql-injection-via-myscale-vector-store-search-by-full-text third-party-advisory