What’s Vulnerable › Vulnerabilities

CVE-2024-10252: Code Injection in langgenius/dify

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-20 · updated 2026-06-17
• Weakness: CWE-94

Description

A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service. This vulnerability enables an attacker to execute arbitrary Python code with root privileges within the sandbox environment, potentially leading to the deletion of the entire sandbox service and causing irreversible damage.

Affected products

• langgenius dify: through 0.9.1

References

• https://github.com/langgenius/dify/commit/4ac99ffe0e1c9f4d7c523908e91bbc7739e0a8d4
• https://huntr.com/bounties/62c6c958-96cb-426c-aebc-c41f06b9d7b0

Get alerted when CVE-2024-10252 or the next vulnerability affects your stack