What’s Vulnerable › Vulnerabilities

CVE-2025-3467: XSS Vulnerability in langgenius/dify

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-07-07 · updated 2026-09-30
• Weakness: CWE-79

Description

An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This vulnerability allows an attacker to obtain the administrator's token by sending a payload in the published chat. When the administrator views the conversation content through the monitoring/log function using Firefox, the XSS vulnerability is triggered, potentially exposing sensitive token information to the attacker.

Affected products

• langgenius dify: before 1.1.3 — fixed in 1.1.3

How to fix

Upgrade to a fixed version: langgenius dify 1.1.3. Check the vendor advisory for mitigations.

References

• https://github.com/langgenius/dify/commit/72deb3bed0b0d5d98d7cf44b525cc44bb278f6a7
• https://huntr.com/bounties/21723441-7b55-425c-abc4-b1331a713591

Get alerted when CVE-2025-3467 or the next vulnerability affects your stack