CVE-2025-3466criticalCWE-1100

CVE-2025-3466: falha crítica em langgenius/dify

Unsanitized Input in langgenius/dify

Publicada em

Seguir esta CVE+ Monitorar langgenius/dify

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.8%
langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. The vulnerability arises from the ability to override global functions in JavaScript, such as parseInt, before sandbox security restrictions are imposed. This can lead to unauthorized access to secret keys, internal network servers, and lateral movement within dify.ai. The issue is resolved in version 1.1.3.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
langgenius · langgenius/dify
CVEs relacionadas — langgenius/dify

No mesmo produto, das mais perigosas para as menos.

CVE-2025-0185HIGHPandas Query Injection in langgenius/difyEPSS 1.1%CVE-2024-10252HIGHCode Injection in langgenius/difyEPSS 0.8%CVE-2025-11750MEDIUMUser Enumeration via Distinct Error Messages in langgenius/dify-webEPSS 0.7%CVE-2024-12039HIGHImproper Restriction of Excessive Authentication Attempts in langgenius/difyEPSS 0.7%CVE-2024-12776HIGHAuthentication Bypass in langgenius/difyEPSS 0.7%CVE-2024-12775MEDIUMSSRF in langgenius/difyEPSS 0.7%