DIFY vulnerable to Clickjacking Attack
Priority MEDIUM 45CWE-1021Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-1021.
Summary
DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially compromising the security and privacy of users. This issue has been fixed in version 1.3.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00243 15th percentileScored 2026-11-07
Fix Fixed dify (langgenius): 1.3.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| langgenius | dify | before 1.3.0 | 1.3.0 | Patch available | CNA |
- dify Vendorlanggenius Affected before 1.3.0 Fixed in 1.3.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:langgenius:dify:*:*:*:*:*:node.js:*:* | up to 0.6.8 | Vulnerable | langgenius |
- cpe:2.3:a:langgenius:dify:*:*:*:*:*:node.js:*:* Versions up to 0.6.8 Vulnerable ·langgenius
Remediation
- Fix · CNA dify (langgenius) Fixed in 1.3.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-43854
References
More langgenius Dify vulnerabilities
- TI-2025-35265 Default credentials in Dify thru 1.5.1. CVSS 3.1CRITICAL 9.8
- TI-2025-03045 Unsanitized Input in langgenius/dify CVSS 3.1HIGH 7.2
- TI-2025-01548 Admin account takeover through weak Pseudo-Random number generator used in generating… CVSS 3.1HIGH 8.8
- TI-2026-30470 Dify Vulnerable to Stored XSS via SVG-file upload CVSS 4.0MEDIUM 6.9
- TI-2024-11840 Authentication Bypass in langgenius/dify CVSS 3.0HIGH 8.1
- TI-2024-11170 Improper Restriction of Excessive Authentication Attempts in langgenius/dify CVSS 3.1HIGH 8.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences