EUVD-2025-20212

| CVE-2025-3466 HIGH
2025-07-07 [email protected]
7.2
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Mar 16, 2026 - 03:37 vuln.today
EUVD ID Assigned
Mar 16, 2026 - 03:37 euvd
EUVD-2025-20212
Patch Released
Mar 16, 2026 - 03:37 nvd
Patch available
PoC Detected
Jul 10, 2025 - 15:01 vuln.today
Public exploit code
CVE Published
Jul 07, 2025 - 10:15 nvd
HIGH 7.2

Tags

RCE Authentication Bypass Dify

Description

langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. The vulnerability arises from the ability to override global functions in JavaScript, such as parseInt, before sandbox security restrictions are imposed. This can lead to unauthorized access to secret keys, internal network servers, and lateral movement within dify.ai. The issue is resolved in version 1.1.3.

Analysis

CVE-2025-3466 is a security vulnerability (CVSS 7.2). Risk factors: public PoC available. Vendor patch is available.

Technical Context

Vulnerability type not specified by vendor. CVSS 7.2 indicates high severity.

Affected Products

['Unspecified product']

Remediation

Apply the vendor-supplied patch immediately.

Priority Score

56
Low Medium High Critical
KEV: 0
EPSS: +0.2
CVSS: +36
POC: +20

Share

EUVD-2025-20212 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy