CVE-2024-10252: Code Injection in langgenius/dify

Q: What is the severity of CVE-2024-10252?

CVE-2024-10252 is a critical vulnerability that allows code injection with root privileges.

Q: How do I fix CVE-2024-10252?

To fix CVE-2024-10252, upgrade langgenius/dify to a version greater than 0.9.1.

Q: What systems are affected by CVE-2024-10252?

CVE-2024-10252 affects langgenius/dify versions up to and including 0.9.1.

Q: What type of attack does CVE-2024-10252 enable?

CVE-2024-10252 enables an attacker to execute arbitrary Python code within the Dify sandbox.

Q: Is CVE-2024-10252 exploitable remotely?

Yes, CVE-2024-10252 is exploitable via internal SSRF requests.

Published Mar 20, 2025

Updated

A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service. This vulnerability enables an attacker to execute arbitrary Python code with root privileges within the sandbox environment, potentially leading to the deletion of the entire sandbox service and causing irreversible damage.

Affected Software

2 affected components

LangGenius Dify<=0.9.1

LangGenius Dify Node.js<=0.9.1

Event History

Mar 20, 2025

CVE Published

via MITRE·10:10 AM

Data Sourced

via MITRE·10:10 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-10252?

CVE-2024-10252 is a critical vulnerability that allows code injection with root privileges.

How do I fix CVE-2024-10252?

To fix CVE-2024-10252, upgrade langgenius/dify to a version greater than 0.9.1.

What systems are affected by CVE-2024-10252?

CVE-2024-10252 affects langgenius/dify versions up to and including 0.9.1.

What type of attack does CVE-2024-10252 enable?

CVE-2024-10252 enables an attacker to execute arbitrary Python code within the Dify sandbox.

Is CVE-2024-10252 exploitable remotely?