CVE-2025-3466: Unsanitized Input in langgenius/dify
langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. The vulnerability arises from the ability to override global functions in JavaScript, such as parseInt, before sandbox security restrictions are imposed. This can lead to unauthorized access to secret keys, internal network servers, and lateral movement within dify.ai. The issue is resolved in version 1.1.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
langgenius/difyto a version that resolves this vulnerability.Fixed in 1.1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3466?
CVE-2025-3466 is considered a critical vulnerability due to the potential for arbitrary code execution with full root permissions.
How do I fix CVE-2025-3466?
To mitigate CVE-2025-3466, upgrade to version 1.1.3 or later of langgenius/dify, which addresses the unsanitized input issue.
What versions of langgenius/dify are affected by CVE-2025-3466?
CVE-2025-3466 affects langgenius/dify versions 1.1.0 to 1.1.2.
What kind of attack can CVE-2025-3466 enable?
CVE-2025-3466 can enable attackers to execute arbitrary JavaScript code, potentially compromising the entire system.
Is CVE-2025-3466 related to JavaScript security?
Yes, CVE-2025-3466 involves vulnerabilities in JavaScript that allow overriding of global functions, compromising the sandbox environment.