CVE-2025-0185: Pandas Query Injection in langgenius/dify
A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version. The vulnerability occurs in the function vn.gettrainingplangeneric(dfinformationschema), which does not properly sanitize user inputs before executing queries using the Pandas library. This can potentially lead to Remote Code Execution (RCE) if exploited.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0185?
CVE-2025-0185 has a high severity rating due to the potential for Pandas Query Injection that can compromise data integrity.
How do I fix CVE-2025-0185?
To fix CVE-2025-0185, ensure that user inputs are properly sanitized in the `vn.get_training_plan_generic(df_information_schema)` function.
What software versions are affected by CVE-2025-0185?
CVE-2025-0185 affects the latest version of the Dify Tools' Vanna module in the langgenius/dify repository.
What is the impact of CVE-2025-0185?
The impact of CVE-2025-0185 includes potential exposure to unauthorized data manipulation and exploitation of application logic.
Is there a workaround for CVE-2025-0185?
A temporary workaround for CVE-2025-0185 could involve manually validating and sanitizing user inputs before processing them.