CVE-2025-3466 Overview
CVE-2025-3466 affects langgenius/dify versions 1.1.0 through 1.1.2, an open-source LLM application development platform. The vulnerability allows authenticated attackers to escape the JavaScript code node sandbox and execute arbitrary code with root permissions. Attackers exploit the flaw by overriding global JavaScript functions such as parseInt before sandbox security restrictions are applied. Successful exploitation grants access to secret keys, internal network servers, and enables lateral movement within dify.ai deployments. The maintainer resolved the issue in version 1.1.3.
Critical Impact
Authenticated attackers achieve arbitrary code execution with root privileges, exposing secrets and enabling lateral movement across internal infrastructure.
Affected Products
- langgenius/dify version 1.1.0
- langgenius/dify version 1.1.1
- langgenius/dify version 1.1.2
Discovery Timeline
- 2025-07-07 - CVE-2025-3466 published to NVD
- 2025-07-10 - Last updated in NVD database
Technical Details for CVE-2025-3466
Vulnerability Analysis
The vulnerability resides in the JavaScript code node feature of dify, which lets workflow authors run user-supplied JavaScript. Dify executes this code inside a sandbox intended to restrict access to host resources and sensitive APIs. The sandbox initializes its security restrictions after user-controlled code has the opportunity to redefine global functions. This ordering flaw enables a sandbox escape that yields full root execution on the underlying host. The Common Weakness Enumeration classification is [CWE-1100] (Insufficient Isolation of System-Dependent Functions).
Root Cause
The root cause is improper sequencing between user code evaluation and sandbox hardening. Global JavaScript functions including parseInt can be overridden before the sandbox imposes its restrictions. When the sandbox subsequently invokes these built-ins as part of its enforcement logic, it executes attacker-controlled replacements with elevated context. The fix in version 1.1.3 reorders initialization so security restrictions apply before user input runs.
Attack Vector
An authenticated user with permission to create or modify a workflow code node submits JavaScript that redefines global functions. When the workflow executes, the malicious overrides run inside the trusted sandbox initialization path. The attacker then reads environment variables containing secret keys, pivots to internal services reachable from the dify host, and moves laterally across the dify.ai environment. Network reachability to the dify API is the only prerequisite beyond valid credentials.
For full technical details, see the Huntr Bounty Report and the upstream patch commit.
Detection Methods for CVE-2025-3466
Indicators of Compromise
- Unexpected outbound connections from the dify code execution container to internal services or metadata endpoints.
- Code node payloads that redefine JavaScript built-ins such as parseInt, Array.prototype, or Object.prototype.
- Workflow execution logs showing access to environment variables, secret stores, or filesystem paths outside the sandbox working directory.
- Process activity running as root originating from the dify sandbox runtime.
Detection Strategies
- Inspect stored workflow definitions for code nodes containing reassignments of global JavaScript functions.
- Correlate workflow execution events with subsequent network connections to non-standard internal destinations.
- Alert on read access to credential files, .env contents, or cloud instance metadata services from dify worker processes.
Monitoring Recommendations
- Centralize dify application and sandbox logs and retain workflow execution history for forensic review.
- Monitor egress traffic from dify hosts and flag connections to private address ranges or metadata IPs such as 169.254.169.254.
- Track creation and modification of code nodes by non-administrative accounts.
How to Mitigate CVE-2025-3466
Immediate Actions Required
- Upgrade all dify deployments to version 1.1.3 or later without delay.
- Rotate all secrets, API keys, and service credentials accessible to dify workers, assuming prior exposure.
- Audit existing workflows for code nodes that override global JavaScript functions or attempt sandbox introspection.
- Restrict code node creation permissions to trusted administrators until the upgrade is verified.
Patch Information
The maintainer fixed the issue in dify version 1.1.3. The remediation is included in commit 1be0d26c1feb4bcbbdd2b4ae4eeb25874aadaddb. Operators running versions 1.1.0, 1.1.1, or 1.1.2 must upgrade to remove the vulnerable code path.
Workarounds
- Disable the JavaScript code node feature for non-administrative users until the upgrade is applied.
- Run the dify sandbox container as a non-root user with a read-only root filesystem.
- Apply egress network policies that prevent dify workers from reaching internal services and cloud metadata endpoints.
- Place dify behind an authenticated reverse proxy and limit access to known IP ranges.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
