High severity7.2NVD Advisory· Published Mar 20, 2025· Updated Jun 17, 2026
CVE-2024-10252
CVE-2024-10252
Description
A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service. This vulnerability enables an attacker to execute arbitrary Python code with root privileges within the sandbox environment, potentially leading to the deletion of the entire sandbox service and causing irreversible damage.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:langgenius:dify:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:langgenius:dify:*:*:*:*:*:node.js:*:*range: <=0.9.1
- (no CPE)range: <=v0.9.1
- langgenius/langgenius/difyv5Range: unspecified
Patches
Vulnerability mechanics
References
2- github.com/langgenius/dify/commit/4ac99ffe0e1c9f4d7c523908e91bbc7739e0a8d4nvdPatch
- huntr.com/bounties/62c6c958-96cb-426c-aebc-c41f06b9d7b0nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.