Langgenius Dify Code Injection Vulnerability in Dify Sandbox Service

A code injection vulnerability has been identified in Langgenius Dify versions through v0.9.1. This issue arises from internal Server-Side Request Forgery (SSRF) requests within the Dify sandbox service, allowing attackers to execute arbitrary Python code with root privileges in the sandbox environment. The exploitation of this vulnerability could result in the complete deletion of the sandbox service, causing irreversible damage.

Impact

Exploitation of this vulnerability allows for arbitrary code execution with root privileges in the Dify sandbox environment, potentially leading to the complete destruction of the sandbox service.

Remediation

Users can update to Dify version 0.10.0 or later to address this vulnerability.