CVE-2025-58747: Langgenius Dify XSS Vulnerability

CVE-2025-58747 Overview

CVE-2025-58747 is a cross-site scripting (XSS) vulnerability in Dify, an open-source large language model (LLM) application development platform maintained by Langgenius. The flaw affects Dify versions through 1.9.1 and resides in the Model Context Protocol (MCP) OAuth component. The authorization_url returned by a remote MCP server is passed directly to window.open without validation, allowing an attacker-controlled server to return a javascript: URI that executes in the victim's browser context.

Critical Impact
An attacker operating a malicious MCP server can execute arbitrary JavaScript in the Dify application context when a victim initiates an OAuth connection [CWE-79].

Affected Products

Langgenius Dify versions through 1.9.1 (Node.js distribution)
Dify MCP OAuth component (web/hooks/use-oauth.ts)
Self-hosted and containerized Dify deployments exposing MCP client functionality

Discovery Timeline

2025-10-17 - CVE-2025-58747 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58747

Vulnerability Analysis

The vulnerability exists in Dify's MCP OAuth client flow. When a Dify user connects to a remote MCP server, the server responds with an authorization_url field that Dify opens in a new window to begin the OAuth handshake. The frontend passes this value directly to window.open without protocol validation. Because window.open executes any URI scheme it receives, an attacker can substitute a javascript: URI in place of a legitimate https:// authorization endpoint.

When the victim clicks the connect action, the injected script runs inside the origin of the Dify web application. The attacker can then read session tokens, exfiltrate workspace data, invoke API endpoints as the victim, or pivot to further application-layer attacks. The EPSS score of 5.308% (91.6 percentile) reflects meaningful predicted exploitation interest despite the low CVSS base score, which is limited by the required user interaction.

Root Cause

The root cause is missing input validation on an untrusted URL string. The OAuth callback hook trusted the remote MCP server as an authoritative source for redirection targets. No allow-list of URL schemes was enforced before invoking window.open, permitting javascript:, data:, and other dangerous URI schemes to execute.

Attack Vector

Exploitation requires the victim to attempt an OAuth connection to an attacker-controlled MCP server. The attacker hosts a malicious MCP endpoint that returns a crafted OAuth metadata response with a javascript: URI in the authorization_url field. Delivery vectors include social engineering the victim into adding a rogue MCP server URL or compromising an existing MCP catalog entry.

typescript

// Patch: web/hooks/use-oauth.ts
 'use client'
 import { useEffect } from 'react'
+import { validateRedirectUrl } from '@/utils/urlValidation'

 export const useOAuthCallback = () => {
   useEffect(() => {
// Source: https://github.com/langgenius/dify/commit/bfda4ce7e6f39d43a4420e97e23a18edcfe3e3d3

typescript

// Patch: web/utils/urlValidation.ts
/**
 * Validates that a URL is safe for redirection.
 * Only allows HTTP and HTTPS protocols to prevent XSS attacks.
 */
export function validateRedirectUrl(url: string): void {
  try {
    const parsedUrl = new URL(url);
    if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
      throw new Error("Authorization URL must be HTTP or HTTPS");
    }
  } catch (error) {
    if (
      error instanceof Error &&
      error.message === "Authorization URL must be HTTP or HTTPS"
    ) {
      throw error;
    }
    throw new Error(`Invalid URL: ${url}`);
  }
}
// Source: https://github.com/langgenius/dify/commit/bfda4ce7e6f39d43a4420e97e23a18edcfe3e3d3

Detection Methods for CVE-2025-58747

Indicators of Compromise

MCP server responses containing an authorization_url field beginning with javascript:, data:, vbscript:, or other non-HTTP schemes
Outbound connections from Dify instances to unrecognized MCP server hostnames prior to unexpected browser script execution
Browser telemetry showing script execution originating from window.open calls within the Dify OAuth callback flow

Detection Strategies

Inspect HTTP responses from remote MCP endpoints for OAuth metadata fields carrying non-HTTP(S) URI schemes
Review Dify web application logs for MCP connection attempts followed by anomalous session token access
Deploy Content Security Policy (CSP) reporting to capture blocked script executions that indicate exploitation attempts

Monitoring Recommendations

Alert on Dify workspaces adding new remote MCP server registrations, especially to domains outside a curated allow-list
Monitor for unusual API activity following MCP connection events, including workspace exports or credential retrieval
Correlate reverse proxy logs with MCP client traffic to detect servers returning malformed OAuth discovery documents

How to Mitigate CVE-2025-58747

Immediate Actions Required

Upgrade Dify to the version containing commit bfda4ce7e6f39d43a4420e97e23a18edcfe3e3d3, which introduces validateRedirectUrl
Restrict which MCP servers users can register by enforcing an administrative allow-list
Educate operators to avoid connecting workspaces to untrusted or unverified remote MCP endpoints

Patch Information

Langgenius published the fix in the GitHub Security Advisory GHSA-9jch-j9qf-vqfw. The remediation adds a validateRedirectUrl helper that parses the incoming URL and rejects any protocol other than http: or https: before it is passed to window.open. Review the GitHub commit changes for the exact diff applied to web/hooks/use-oauth.ts and web/utils/urlValidation.ts.

Workarounds

Block the MCP connection UI at the reverse proxy or ingress layer until upgrade is complete
Apply a strict Content Security Policy that disallows inline script execution and javascript: navigation targets
Manually patch use-oauth.ts to wrap window.open calls with URL protocol validation limited to HTTP and HTTPS

bash

# Verify the patched files after upgrade
grep -R "validateRedirectUrl" web/utils/ web/hooks/
git log --oneline | grep bfda4ce7e6f39d43a4420e97e23a18edcfe3e3d3