CVE-2026-18632: Langgenius Dify RCE Vulnerability

CVE-2026-18632 Overview

CVE-2026-18632 is a template injection vulnerability in langgenius dify versions up to 1.14.2. The flaw resides in the jinja2.Template function within api/core/helper/code_executor/jinja2/jinja2_transformer.py, part of the Jinja2 Handler component. The issue stems from improper neutralization of special elements used in a template engine [CWE-791]. Attackers can exploit this remotely with low privileges over the network. Public exploit code has been released. The vendor was contacted before disclosure but did not respond.

Critical Impact
A remote authenticated attacker can inject unsafe template syntax into the Jinja2 handler in dify, potentially altering rendered output and affecting confidentiality, integrity, and availability of the application.

Affected Products

langgenius dify versions up to and including 1.14.2
Component: Jinja2 Handler (api/core/helper/code_executor/jinja2/jinja2_transformer.py)
Function: jinja2.Template

Discovery Timeline

2026-08-03 - CVE-2026-18632 published to the National Vulnerability Database
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18632

Vulnerability Analysis

The vulnerability originates in dify's Jinja2 transformer, which passes untrusted input to the jinja2.Template constructor without adequate sanitization. Jinja2 templates support expression evaluation, attribute access, and filter chaining. Any input that reaches the template compiler without neutralization of control characters, delimiters, or expression syntax can alter template semantics. This class of flaw is classified under [CWE-791] (Incomplete Filtering of Special Elements) and commonly leads to server-side template injection.

Because dify is an LLM application platform that composes prompts and code execution artifacts from user-controllable fields, template constructs crafted by an attacker can influence output rendered to other users or downstream code executors. The attack requires low privileges but does not require user interaction, and can be executed over the network.

Root Cause

The root cause is the direct construction of a Jinja2 template object from data that is not first filtered for template metacharacters such as {{, }}, {%, %}, {#, and #}. Without a sandboxed environment or strict allowlist, the template engine interprets these sequences as executable expressions rather than literal content.

Attack Vector

An authenticated remote attacker submits a payload containing Jinja2 template syntax to a dify endpoint that routes user data through jinja2_transformer.py. When the handler invokes jinja2.Template, the injected syntax is compiled and evaluated on the server. The exploit has been publicly disclosed, increasing the likelihood of opportunistic use. See the GitHub CVE Issue Discussion and VulDB CVE-2026-18632 Report for reproduction details.

Detection Methods for CVE-2026-18632

Indicators of Compromise

Requests to dify API endpoints containing Jinja2 delimiters such as {{, }}, {%, or {# in fields that should hold plain text or user prompts.
Application logs showing jinja2.exceptions.TemplateSyntaxError or UndefinedError originating from api/core/helper/code_executor/jinja2/jinja2_transformer.py.
Unexpected process spawning from the dify API container immediately following template rendering operations.

Detection Strategies

Instrument the jinja2_transformer.py code path to log all raw inputs before template compilation and alert on the presence of template metacharacters.
Deploy a web application firewall rule that inspects POST bodies to dify endpoints for Jinja2 expression patterns.
Correlate authenticated dify API activity with outbound network connections or file writes from the API container to surface post-injection behavior.

Monitoring Recommendations

Monitor dify application logs for template rendering errors and repeated 500-class responses from workflow execution endpoints.
Track process lineage from the dify API service to identify unauthorized subprocess execution.
Baseline normal prompt content length and character distribution, and alert on submissions with a high density of {, }, %, and # characters.

How to Mitigate CVE-2026-18632

Immediate Actions Required

Restrict access to dify instances to trusted users and networks until a vendor patch is available, since the vendor has not responded to disclosure.
Audit any custom workflows that pass user-controlled data into Jinja2-based nodes and remove or sanitize those inputs.
Rotate credentials and API keys that were exposed to the dify runtime if compromise is suspected.

Patch Information

No vendor patch has been published as of the CVE publication date. The vendor was contacted prior to disclosure but did not respond. Track the GitHub CVE Issue Discussion and VulDB Vulnerability Details for updates.

Workarounds

Replace direct jinja2.Template usage with jinja2.sandbox.SandboxedEnvironment to restrict attribute access and dangerous builtins.
Apply strict input validation that rejects or escapes template delimiters ({{, }}, {%, %}, {#, #}) on any field routed through the Jinja2 handler.
Run the dify API service under a non-privileged account with restrictive filesystem and network egress controls to limit the blast radius of successful injection.

bash

# Configuration example - reverse proxy filter to block Jinja2 delimiters in dify requests
# nginx example: reject request bodies containing template metacharacters
location /v1/ {
    if ($request_body ~* "(\{\{|\}\}|\{%|%\}|\{#|#\})") {
        return 400 "Template syntax not permitted";
    }
    proxy_pass http://dify_api_upstream;
}