langgenius/dify vulnerabilities
8 known vulnerabilities in langgenius/dify from LangGenius. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
langgenius/dify: Insufficient Isolation of System-Dependent Functions
langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. The vulnerability arises from the ability to override global functions in JavaScript, such as parseIn
- 8.8 High severity
langgenius/dify: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator (PRNG) used for generating password reset codes. The application uses `random.randint`
- 8.8 High severity
langgenius/dify: Improper Control of Generation of Code
A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version. The vulnerability occurs in the function `vn.get_training_plan_generic(df_information_schema)`, which does not properly
- 8.1 High severity
langgenius/dify: Authentication Bypass by Primary Weakness
In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the applicatio
- 8.1 High severity
langgenius/dify: Improper Restriction of Excessive Authentication Attempts
langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows an unauthenticated attacker to reset owner, admin, or other user passwords within a few hours by gue
- 7.6 High severity
langgenius/dify: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. The vulnerability arises because certain HTML tags like <input> and <form> are not disallowed, allowing an attacker to injec
- 7.5 High severity
langgenius/dify: Server-Side Request Forgery
langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the api_endpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead
- 7.2 High severity
langgenius/dify: Improper Control of Generation of Code
A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service. This vulnerability enables an attacker to execute arbitrary Python code with root privileges within the sandbox environment,