Back to search
CVE-2025-43854
Published: Apr 28, 2025
Modified: Apr 28, 2025
PUBLISHED
Description
DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially compromising the security and privacy of users. This issue has been fixed in version 1.3.0.
| Vendor | Product | Versions |
|---|---|---|
langgenius | dify | affected < 1.3.0 |
Weaknesses (CWE)
References
https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p
x_refsource_CONFIRM
https://github.com/langgenius/dify/pull/18516
x_refsource_MISC
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now