Answer in brief
CVE-2026-61461 records a High severity (CVSS 8.7) vulnerability in Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text. The current sources do not mark it as known exploited. The current feed maps langgenius/dify (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps langgenius/dify (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| langgenius/difygeneric | >=0 <1.16.0-rc1 | 1.16.0-rc1 |
Published upstream
Jul 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 10, 2026
Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.
Quoted source text, attributed separately from HOL analysis.