CVE-2024-10252highCWE-94

CVE-2024-10252: high-severity vulnerability in langgenius/dify

Code Injection in langgenius/dify

Published · Updated

Follow this CVE+ Monitor langgenius/dify

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.8%
A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service. This vulnerability enables an attacker to execute arbitrary Python code with root privileges within the sandbox environment, potentially leading to the deletion of the entire sandbox service and causing irreversible damage.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
langgenius · langgenius/dify
Related CVEs — langgenius/dify

In the same product, most dangerous first.

CVE-2025-0185HIGHPandas Query Injection in langgenius/difyEPSS 1.1%CVE-2025-3466CRITICALUnsanitized Input in langgenius/difyEPSS 0.8%CVE-2025-11750MEDIUMUser Enumeration via Distinct Error Messages in langgenius/dify-webEPSS 0.7%CVE-2024-12039HIGHImproper Restriction of Excessive Authentication Attempts in langgenius/difyEPSS 0.7%CVE-2024-12776HIGHAuthentication Bypass in langgenius/difyEPSS 0.7%CVE-2024-12775MEDIUMSSRF in langgenius/difyEPSS 0.7%