CyberSecBulletin

Dify vulnerabilities

We track 2 vulnerabilities in Dify products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on March 20, 2025.

2vulnerabilities
0critical
2high
0exploited
8.2average CVSS score

Latest Dify vulnerabilities

  • 8.8 High severity

    langgenius/dify: Improper Control of Generation of Code

    CVE-2025-0185LangGeniusEPSS 1.1%

    A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version. The vulnerability occurs in the function `vn.get_training_plan_generic(df_information_schema)`, which does not properly

  • 7.5 High severity

    langgenius/dify: Server-Side Request Forgery

    CVE-2024-11822LangGenius

    langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the api_endpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead