CVE-2025-3466
Langgenius Dify 1.1.0 – 1.1.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-3466 is a high-severity Insufficient Isolation of System-Dependent Functions (CWE-1100) vulnerability in Langgenius Dify. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 49% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified map to SC-32 (System Partitioning) and SC-2 (Separation of System and User Functionality) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20212
Vulnerability Data
langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. The vulnerability arises from the ability to override global functions in JavaScript, such as parseInt, before sandbox…
more
security restrictions are imposed. This can lead to unauthorized access to secret keys, internal network servers, and lateral movement within dify.ai. The issue is resolved in version 1.1.3.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai, dify
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Requires partitioning the system into distinct components in separate domains, structurally preventing mixed system-dependent functionality.
Requires explicit separation of user and system-management functionality into distinct modules.
Mandates isolation of security functions from non-security functions, directly addressing modular separation of system-dependent code.
Enforces separate execution domains per process, limiting mixing of system-dependent logic.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce modular isolation of system-dependent functions during design and coding.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure system architecture and engineering principles explicitly require modular isolation of system-dependent functions.
Secure development life cycle processes encourage modular design but do not specifically address isolation of system-dependent functions.
Secure coding standards mandate separating platform-specific code into distinct modules to reduce coupling.
Separation of development, test and production environments indirectly benefits from modular isolation but does not enforce it.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 9 (1 rule)
- V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-1100