CVE-2025-43854
Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent.
Does this matter?
Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.
Description
DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially compromising the security and privacy of users. This issue has been fixed in version 1.3.0.
- CVSS 4.0
- 2.3 LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.23% probability · 14th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1021
- Affected
- langgenius/dify
- Source
- security-advisories@github.com
References
- https://github.com/langgenius/dify/pull/18516Issue Tracking, Patch
- https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5pVendor Advisory
- https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5pVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.