CVE-2025-3467: Langgenius Dify XSS Vulnerability

CVE-2025-3467 Overview

CVE-2025-3467 is a stored cross-site scripting (XSS) vulnerability in langgenius/dify versions prior to 1.1.3. The flaw affects administrators viewing conversation logs in Firefox browsers. An attacker sends a crafted payload through a published chat interface. When an administrator reviews the conversation using the monitoring or log function in Firefox, the payload executes in the administrator's browser context. This can expose the administrator's session token to the attacker, enabling account takeover of the Dify management interface.

Critical Impact
Attackers can steal administrator tokens by planting XSS payloads in published chat conversations, leading to potential administrative account compromise.

Affected Products

langgenius/dify versions prior to 1.1.3
Deployments served through Node.js
Administrator sessions using Firefox to view chat monitoring logs

Discovery Timeline

2025-07-07 - CVE-2025-3467 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3467

Vulnerability Analysis

The vulnerability is a stored XSS issue classified under CWE-79. Dify renders chat content, including SVG payloads, inside the administrator monitoring and logs interface. The rendering path did not sanitize embedded SVG markup before insertion into the DOM. Firefox permits script execution inside inline SVG elements, so payloads embedded in a chat message trigger script execution when the administrator opens the conversation log.

Because the malicious content is persisted server-side in conversation history, the attacker does not need to interact with the administrator directly. Any administrator who later reviews the tainted conversation in Firefox executes the payload. Script execution in the administrator origin exposes authentication tokens, cookies, and any state accessible from the Dify web application.

Root Cause

The root cause is missing sanitization of SVG content in the markdown rendering pipeline. The pre-patch code path in web/app/components/base/markdown.tsx and web/app/components/base/svg-gallery/index.tsx rendered attacker-controlled SVG without stripping executable script vectors. The fix introduces DOMPurify sanitization and routes SVG rendering through a dedicated SVGRenderer component.

Attack Vector

An authenticated low-privilege user with access to a published chat submits a message containing an SVG payload with embedded script logic. The payload is stored in the conversation record. When an administrator opens the monitoring or log view in Firefox, the SVG is rendered inline and the script executes. The script can read the administrator's token from browser storage and exfiltrate it to an attacker-controlled endpoint.

text

// Security patch in web/app/components/base/markdown.tsx
 import { Theme } from '@/types/app'
 import useTheme from '@/hooks/use-theme'
 import cn from '@/utils/classnames'
+import SVGRenderer from './svg-gallery'

// Security patch in web/app/components/base/svg-gallery/index.tsx
 import { useEffect, useRef, useState } from 'react'
 import { SVG } from '@svgdotjs/svg.js'
 import ImagePreview from '@/app/components/base/image-uploader/image-preview'
+import DOMPurify from 'dompurify'

 export const SVGRenderer = ({ content }: { content: string }) => {
   const svgRef = useRef<HTMLDivElement>(null)

Source: langgenius/dify commit 72deb3b

Detection Methods for CVE-2025-3467

Indicators of Compromise

Chat messages containing inline <svg> elements with <script> tags or event handler attributes such as onload or onerror.
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after opening a conversation log.
Administrator API calls originating from IP addresses or user-agents that do not match normal operator activity.

Detection Strategies

Inspect stored conversation content for SVG payloads, embedded JavaScript URIs, and DOM event handlers.
Correlate administrator token usage with the IP addresses and browser fingerprints of legitimate admin sessions.
Review reverse proxy or web application firewall (WAF) logs for POST requests to chat endpoints containing SVG markup.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting for the Dify web console and forward violations to the SIEM.
Alert on new administrator sessions created without a preceding authentication event.
Monitor for anomalous access patterns to the monitoring and logs endpoints under /console/api/apps/*/messages.

How to Mitigate CVE-2025-3467

Immediate Actions Required

Upgrade langgenius/dify to version 1.1.3 or later, which introduces DOMPurify sanitization of SVG content.
Rotate any administrator tokens or API keys that may have been used in Firefox while viewing conversation logs.
Audit published chat conversations for stored SVG payloads and remove suspicious entries.

Patch Information

The fix is delivered in commit 72deb3bed0b0d5d98d7cf44b525cc44bb278f6a7. The patch adds a dedicated SVGRenderer component and applies DOMPurify to sanitize SVG content before rendering it in the markdown component. See the Huntr bounty report for additional technical context.

Workarounds

Restrict administrator access to the monitoring and logs interface to Chromium-based browsers until upgrade is complete.
Deploy a strict Content Security Policy that blocks inline scripts and disallows script execution inside SVG elements.
Place a WAF rule in front of chat submission endpoints to reject request bodies containing <script> or SVG event handler attributes.

bash

# Upgrade Dify to the patched release
git fetch --tags
git checkout 1.1.3
docker compose pull
docker compose up -d

# Example CSP header for the Dify web console
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';";