CVE-2025-49149: Dify has XSS vulnerability
Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting (XSS) attack when a user browses these web pages. At time of posting, there is no known patched version.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49149?
CVE-2025-49149 is rated as a critical vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2025-49149?
To fix CVE-2025-49149, ensure that user input is properly sanitized and validated before being rendered in web applications.
What types of attacks are possible due to CVE-2025-49149?
CVE-2025-49149 can lead to cross-site scripting (XSS) attacks, enabling attackers to execute malicious scripts in users' browsers.
Which software is affected by CVE-2025-49149?
CVE-2025-49149 affects version 1.2.0 of the open-source Dify application development platform.
How can I identify if my application is vulnerable to CVE-2025-49149?
You can identify vulnerability to CVE-2025-49149 by reviewing the application for insufficient filtering of user input and testing for XSS exploits.