CVE-2025-3467
Medium
Description
An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This vulnerability allows an attacker to obtain the administrator's token by sending a payload in the published chat. When the administrator views the conversation content through the monitoring/log function using Firefox, the XSS vulnerability is triggered, potentially exposing sensitive token information to the attacker.
SeverityMedium
CVSS5.4
Exploit probability—
ProductLanggenius Dify
PublishedJul 7, 2025
First seenJul 7, 2025
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- langgenius dify1.1.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| langgenius dify | v < 1.1.3 | 1.1.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.