PT-2025-25765 · Dify · Dify

Mia0A-Hi · Published 2025-06-17 · Updated 2025-08-01 · CVE-2025-49149

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dify version 1.2.0

Description Dify is an open-source LLM app development platform. In this platform, there is insufficient filtering of user input by web applications, which allows attackers to inject malicious script code into web pages. This can result in a cross-site scripting (XSS) attack when a user browses these web pages.

Recommendations For version 1.2.0, as a temporary workaround, consider implementing additional input validation and sanitization to prevent malicious script injection until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-49149

GHSA-GRMH-WW4V-5CGJ

Affected Products

Dify

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49149.json · Exploit
• https://github.com/langgenius/dify/security/advisories/GHSA-grmh-ww4v-5cgj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49149 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49149 · Security Note
• https://t.me/cveNotify/130631 · Telegram Post
• https://t.me/cvetracker/26474 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1935142817916956728 · Twitter Post
• https://t.me/cvenotify/126035 · Telegram Post
• https://twitter.com/CVEnew/status/1935108342814490940 · Twitter Post