CVE-2025-58747: Dify MCP OAuth Flow Vulnerable to XSS
Dify is an LLM application development platform. In Dify versions through 1.9.1, the MCP OAuth component is vulnerable to cross-site scripting when a victim connects to an attacker-controlled remote MCP server. The vulnerability exists in the OAuth flow implementation where the authorizationurl provided by a remote MCP server is directly passed to window.open without validation or sanitization. An attacker can craft a malicious MCP server that returns a JavaScript URI (such as javascript:alert(1)) in the authorizationurl field, which is then executed when the victim attempts to connect to the MCP server. This allows the attacker to execute arbitrary JavaScript in the context of the Dify application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dify MCP OAuth componentto a version that resolves this vulnerability.Fixed in 1.9.1 - Configuration
In the MCP OAuth flow, do not pass the remote MCP server's authorization_url directly to window.open; validate/sanitize the authorization_url to allow only safe, expected URL schemes/hosts before opening it.
Dify MCP OAuth flow authorization_url validation/sanitization before window.open = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58747?
CVE-2025-58747 is a high-severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2025-58747?
To fix CVE-2025-58747, update Dify to version 1.9.2 or later where the vulnerability has been patched.
Who is affected by CVE-2025-58747?
CVE-2025-58747 affects users of Dify versions up to and including 1.9.1.
What type of vulnerability is CVE-2025-58747?
CVE-2025-58747 is classified as a cross-site scripting (XSS) vulnerability.
How can attackers exploit CVE-2025-58747?
Attackers can exploit CVE-2025-58747 by tricking victims into connecting to an attacker-controlled remote MCP server during the OAuth flow.