A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service. This vulnerability enables an attacker to execute arbitrary Python code with root privileges within the sandbox environment, potentially leading to the deletion of the entire sandbox service and causing irreversible damage.
References
| Link | Resource |
|---|---|
| https://github.com/langgenius/dify/commit/4ac99ffe0e1c9f4d7c523908e91bbc7739e0a8d4 | Patch |
| https://huntr.com/bounties/62c6c958-96cb-426c-aebc-c41f06b9d7b0 | Exploit Third Party Advisory |
Configurations
History
11 Jul 2025, 20:34
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:langgenius:dify:*:*:*:*:*:node.js:*:* | |
| First Time |
Langgenius dify
Langgenius |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
| References | () https://github.com/langgenius/dify/commit/4ac99ffe0e1c9f4d7c523908e91bbc7739e0a8d4 - Patch | |
| References | () https://huntr.com/bounties/62c6c958-96cb-426c-aebc-c41f06b9d7b0 - Exploit, Third Party Advisory |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-11 20:34
NVD link : CVE-2024-10252
Mitre link : CVE-2024-10252
JSON object : View
Products Affected
langgenius
- dify
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')