CVE-2025-43854: langgenius dify

csirt@kutim:~/threat-intel/cve/CVE-2025-43854

CVSS 6.1 · Medium EPSS 0,24%

Kerentanan Improper Restriction of Rendered UI Layers or Frames pada langgenius dify. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially compromising the security and privacy of users. This issue has been fixed in version 1.3.0.

Rincian

Terbit di NVD: 28 April 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-1021: Improper Restriction of Rendered UI Layers or Frames
EPSS (30 hari): 0,24% peluang dieksploitasi; lebih tinggi dari 13,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
langgenius	dify	Semua versi hingga 0.6.8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p advisory vendor
https://github.com/langgenius/dify/pull/18516 issue tracking · patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.