Langgenius
Langgenius Dify: vulnerabilidades y CVE
Langgenius Dify tiene 33 vulnerabilidades publicadas, 14 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE33
Últimos 12 meses14
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-85022 | Baja (2) | 0.36% | — | 3 sept 2026 | A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx of the… |
| CVE-2026-85021 | Baja (2.1) | 0.50% | — | 3 sept 2026 | A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of the component Splash Layout. This manipulation of the argument… |
| CVE-2026-18632 | Baja (2.1) | 0.39% | — | 3 ago 2026 | A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/code_executor/jinja2/jinja2_transformer.py of the component Jinja2… |
| CVE-2026-41950 | Media (6) | 0.47% | — | 5 may 2026 | Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file… |
| CVE-2026-42138 | Media (6.9) | 0.34% | — | 4 may 2026 | Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS. The method POST /v1/files/upload, which… |
| CVE-2026-6619 | Baja (2) | 0.33% | — | 20 abr 2026 | A vulnerability has been found in langgenius dify up to 1.13.3. Impacted is the function openInNewTab of the file web/app/components/base/image-uploader/image-preview.tsx of the component ImagePreview. The manipulation… |
| CVE-2026-6618 | Baja (2.1) | 0.35% | — | 20 abr 2026 | A flaw has been found in langgenius dify up to 1.13.3. This issue affects the function parse_openai_plugin_json_to_tool_bundle of the file api/core/tools/utils/parser.py of the component ApiBasedToolSchemaParser.… |
| CVE-2026-6617 | Baja (2.1) | 0.35% | — | 20 abr 2026 | A vulnerability was detected in langgenius dify up to 0.6.9. This vulnerability affects the function get_api_tool_provider_remote_schema of the file api/services/tools/api_tools_manage_service.py of the component… |
| CVE-2025-63387 | Alta (7.5) | 30% | — | 18 dic 2025 | Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens.… |
| CVE-2025-56157 | Crítica (9.8) | 0.86% | — | 18 dic 2025 | Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make… |
| CVE-2025-63388 | Crítica (9.1) | 0.22% | — | 18 dic 2025 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary… |
| CVE-2025-63386 | Crítica (9.1) | 0.24% | — | 18 dic 2025 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables… |
| CVE-2025-11750 | Media (5.3) | 0.70% | — | 22 oct 2025 | In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or… |
| CVE-2025-58747 | Baja (2) | 5.7% | — | 17 oct 2025 | Dify is an LLM application development platform. In Dify versions through 1.9.1, the MCP OAuth component is vulnerable to cross-site scripting when a victim connects to an attacker-controlled remote MCP server. The… |
| CVE-2025-59422 | Media (6) | 0.25% | — | 25 sept 2025 | Dify is an open-source LLM app development platform. In version 1.8.1, a broken access control vulnerability on the /console/api/apps/<APP_ID>chat-messages?conversation_id=<CONVERSATION_ID>&limit=10 endpoint allows… |
| CVE-2025-3467 | Media (5.4) | 0.37% | — | 7 jul 2025 | An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This vulnerability allows an attacker to obtain the administrator's token by sending a payload in the… |
| CVE-2025-3466 | Alta (7.2) | 0.78% | — | 7 jul 2025 | langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. The vulnerability arises from the ability to override global… |
| CVE-2025-49149 | Media (5.3) | 0.28% | — | 17 jun 2025 | Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into… |
| CVE-2025-43854 | Baja (2.3) | 0.24% | — | 28 abr 2025 | DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on… |
| CVE-2025-43862 | Alta (7.6) | 0.34% | — | 25 abr 2025 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user.… |
| CVE-2025-32796 | Media (6.5) | 0.42% | — | 18 abr 2025 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disable apps through the API, even though the web UI button for… |
| CVE-2025-32795 | Media (6.5) | 0.30% | — | 18 abr 2025 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly granted permissions to edit APP names, descriptions and icons.… |
| CVE-2025-32790 | Media (4.3) | 0.29% | — | 18 abr 2025 | Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in… |
| CVE-2025-29720 | Media (4.8) | 0.17% | — | 14 abr 2025 | Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi. |
| CVE-2025-1796 | Alta (8.8) | 0.59% | — | 20 mar 2025 | A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator (PRNG) used for generating password reset… |
| CVE-2025-0184 | Media (6.5) | 0.50% | — | 20 mar 2025 | A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship… |
| CVE-2024-12776 | Alta (8.1) | 0.65% | — | 20 mar 2025 | In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead… |
| CVE-2024-12775 | Media (6.5) | 0.65% | — | 20 mar 2025 | langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API `POST… |
| CVE-2024-12039 | Alta (8.1) | 0.67% | — | 20 mar 2025 | langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows an unauthenticated attacker to reset owner, admin, or other… |
| CVE-2024-11850 | Media (5.4) | 0.43% | — | 20 mar 2025 | A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the… |