CVE-2025-43854
DIFY vulnerable to Clickjacking Attack
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
DIFY vulnerable to Clickjacking Attack
DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially compromising the security and privacy of users. This issue has been fixed in version 1.3.0.
Reserved 2025-04-17 | Published 2025-04-28 | Updated 2025-04-28 | Assigner GitHub_MCWE-1021: Improper Restriction of Rendered UI Layers or Frames
github.com/...s/dify/security/advisories/GHSA-jhgq-cx3f-vj5p
github.com/langgenius/dify/pull/18516
Support options
