VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 20, 2025· Updated Oct 15, 2025

Code Injection in langgenius/dify

CVE-2024-10252

Description

A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service. This vulnerability enables an attacker to execute arbitrary Python code with root privileges within the sandbox environment, potentially leading to the deletion of the entire sandbox service and causing irreversible damage.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Langgenius/Difyllm-fuzzy
    Range: <=v0.9.1
  • langgenius/langgenius/difyv5
    Range: unspecified

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.