CVE-2025-49149: Langgenius Dify XSS Vulnerability

CVE-2025-49149 Overview

CVE-2025-49149 affects Dify, an open-source large language model (LLM) application development platform. Version 1.2.0 fails to sufficiently filter user-supplied input rendered by the web application. Attackers can inject malicious script code into web pages served by the platform. When another user browses an affected page, the injected script executes in their browser context, resulting in a stored or reflected cross-site scripting (XSS) attack [CWE-79]. The vendor has not published a patched version at the time of disclosure.

Critical Impact
Attackers can execute arbitrary JavaScript in the browsers of authenticated Dify users, enabling session theft, credential harvesting, and unauthorized actions within the LLM application platform.

Affected Products

Langgenius Dify version 1.2.0
Dify deployments running on Node.js
Any Dify instance exposing user-generated content without input sanitization

Discovery Timeline

2025-06-17 - CVE-2025-49149 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49149

Vulnerability Analysis

The vulnerability is a cross-site scripting flaw classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Dify accepts user-controlled data through web application inputs and reflects that data into rendered HTML without adequate escaping or sanitization. An attacker can craft input containing HTML or JavaScript payloads that the browser then interprets as executable code.

Because Dify is an LLM application development platform, injected scripts run within the context of authenticated sessions that may hold API tokens for underlying model providers, workflow definitions, and organizational data. Successful exploitation can expose these secrets to an attacker-controlled endpoint.

The attack requires user interaction, such as viewing a page containing the malicious payload. No authentication is required to submit the payload, but the impact depends on which user renders the affected content.

Root Cause

The root cause is insufficient filtering and output encoding of user-supplied input within Dify's web application layer. Fields that accept text data are stored and later rendered into the DOM without contextual escaping. When script tags, event handlers, or JavaScript URIs pass through unfiltered, the browser executes them as part of the page.

Attack Vector

An attacker submits crafted input containing script payloads through any Dify surface that reflects user content, such as application names, descriptions, prompt templates, or dataset entries. When a victim navigates to the affected page, the browser parses and executes the injected code. The attacker can then exfiltrate session cookies, invoke authenticated API calls, or pivot to connected LLM provider credentials.

No verified public exploit code is available. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-grmh-ww4v-5cgj.

Detection Methods for CVE-2025-49149

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handler attributes stored in Dify application fields, prompt templates, or dataset records
Outbound HTTP requests from user browsers to unknown domains shortly after loading Dify pages
Anomalous API calls originating from valid Dify user sessions targeting credential or workspace endpoints

Detection Strategies

Review web server and application logs for requests containing HTML entities, script fragments, or encoded payloads submitted to Dify input endpoints
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations produced by injected content
Inspect the Dify database for stored values containing tags such as <script, onerror=, or onload= in user-editable fields

Monitoring Recommendations

Alert on browser Document Object Model (DOM) mutations that add script elements to Dify-rendered pages
Monitor egress traffic from analyst and developer workstations for connections to newly registered or low-reputation domains during Dify sessions
Track authentication tokens and API keys for unusual reuse patterns that suggest session theft

How to Mitigate CVE-2025-49149

Immediate Actions Required

Restrict access to Dify 1.2.0 deployments to trusted internal users until a patch is available
Place Dify behind a web application firewall (WAF) with rules that block common XSS payloads targeting user input fields
Audit existing Dify content for previously stored malicious payloads and remove any suspicious entries

Patch Information

At the time of publication, no patched version of Dify is available. Monitor the Langgenius Dify Security Advisory GHSA-grmh-ww4v-5cgj for updates and apply the fixed release as soon as the vendor issues one.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Require authenticated access for all Dify endpoints and disable anonymous submission of user-generated content
Educate users to avoid clicking untrusted Dify application links and to report unexpected browser behavior

bash

# Example nginx Content Security Policy header for Dify reverse proxy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none';" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;