Vulnerability · Published Apr 28, 2025 · Assigned by GitHub_M

CVE-2025-43854DIFY vulnerable to Clickjacking Attack

Low 2.3

In plain English

A low-severity security flaw in dify from langgenius. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 4.0)2.3Low

Exploit odds (30 days)0.2%top 84.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially compromising the security and privacy of users. This issue has been fixed in version 1.3.0.

Affected products (as reported)

Vendor	Product	Versions
langgenius	dify	< 1.3.0

Weakness: CWE-1021 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p x_refsource_CONFIRM
https://github.com/langgenius/dify/pull/18516 x_refsource_MISC