What is the CVSS score of CVE-2025-3466?

CVE-2025-3466 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Dify are affected by CVE-2025-3466?

CVE-2025-3466 presents moderate security risk rated CVSS 7.2. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2025-3466?

Yes, a public proof-of-concept exploit is available for CVE-2025-3466. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-3466?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Vendor patch is available.

Dify CVE-2025-3466

EUVD-2025-20212 HIGH

Insufficient Isolation of System-Dependent Functions (CWE-1100)

2025-07-07 security@huntr.dev

Authentication Bypass RCE Dify

7.2

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 03:37 euvd

EUVD-2025-20212

Analysis Generated

Mar 16, 2026 - 03:37 vuln.today

Patch released

Mar 16, 2026 - 03:37 nvd

Patch available

PoC Detected

Jul 10, 2025 - 15:01 vuln.today

Public exploit code

CVE Published

Jul 07, 2025 - 10:15 nvd

HIGH 7.2

DescriptionNVD

langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. The vulnerability arises from the ability to override global functions in JavaScript, such as parseInt, before sandbox security restrictions are imposed. This can lead to unauthorized access to secret keys, internal network servers, and lateral movement within dify.ai. The issue is resolved in version 1.1.3.

AnalysisAI

CVE-2025-3466 is a security vulnerability (CVSS 7.2). Risk factors: public PoC available. Vendor patch is available.

Technical ContextAI

Vulnerability type not specified by vendor. CVSS 7.2 indicates high severity.

RemediationAI

Apply the vendor-supplied patch immediately.

CVE-2025-3466 vulnerability details – vuln.today

Back

Dify CVE-2025-3466

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code