CVE-2026-18632

CVE-2026-18632 is a Jinja2 template injection vulnerability in Dify's code executor component. The vulnerable code sits at api/core/helper/code_executor/jinja2/jinja2_transformer.py, where user input flows directly into jinja2.Template() without sanitization. This is a classic template injection, but the context makes it worse: Dify is a low-code LLM application platform that accumulates integrations—LLM API keys, vector database credentials, downstream tool connections. A template injection here doesn't just compromise a string formatter; it potentially compromises every credential the platform touches. The naming itself is a diagnostic signal. This isn't a templating helper buried in a rendering module—it's in a component explicitly labeled "code executor." That label reveals how the original developers thought about this code, and more importantly, how that understanding decayed over time. The abstraction got buried in a helper directory while the platform grew around it, and the original security assumptions never got revised to match. If you're running Dify: treat any instance with the code executor enabled as fully compromised until patched. Assume credentials are exposed. Rotate any API keys, database credentials, or secrets that the Dify instance could have accessed. The vendor's non-response to initial disclosure means there's no official guidance and you may still be on a vulnerable version even now—check the version history explicitly and do not assume 1.14.2 is safe without verifying the jinja2_transformer.py patch is included. This follows a documented pattern in low-code platforms: template injection in "code executor" contexts has appeared across multiple platforms in this category. The attack class isn't new—the targets (AI/LLM infrastructure with accumulated credentials) are just more valuable now. If you're evaluating other low-code AI platforms, audit how they handle template rendering and whether user input can reach template engines without sanitization. The abstraction that makes these platforms accessible to non-developers also makes them easy to misuse insecurely, and that pattern will reproduce.

Reviewed through automated stages and approved by a human before publication.