CVE-2025-49149CWE-79

Dify has XSS vulnerability

Medium · published June 17, 2025

CVSS v4.0
5.3
EPSS
0%
Percentile
19.7
In the wild
Unconfirmed
What it is

Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting (XSS) attack when a user browses these web pages. At time of posting, there is no known patched version.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
EPSS
0.00283 · 19.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-06-17T22:34Z
EPSS history
Timeline
  • 17 JUN 22:34Z
    Dify has XSS vulnerability
    cvelistv5