# CVE-2026-85021 - Dify 1.13.0 client-side (DOM) XSS: the Splash share layout
# (web/app/(shareLayout)/components/splash.tsx) passes the redirect_url query parameter to
# router.replace()/window.location, allowing a javascript: URL to execute. No server
# reflection, so this matches the request carrying a javascript: redirect_url value.
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-85021 Dify - Client-Side DOM XSS via redirect_url"; flow:established,to_server; http.uri; content:"redirect_url="; nocase; fast_pattern; pcre:"/[?&]redirect_url=[^&]*javascript(?::|%3a)/i"; classtype:web-application-attack; reference:cve,CVE-2026-85021; reference:url,https://www.exploit.observer/?keyword=CVE-2026-85021&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=dify&match=exact; sid:1097807; rev:1;)