langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 12:05:30 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

[Security] CVE-2025-55182 (React2Shell RCE) - Fix for version 2.0-beta? #20846

New Issue
Closed
opened 2026-02-21 20:09:21 -05:00 by yindo · 4 comments
yindo commented 2026-02-21 20:09:21 -05:00
Owner
Copy Link
Copy Source

Originally created by @nokaquduc on GitHub (Dec 7, 2025).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

2.0-beta.2

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

I noticed that Dify released 1.10.1-fix.1 to address CVE-2025-55182 (React RCE) and CVE-2025-66478 (Next.js), upgrading React to 19.2.1 and Next.js to 15.5.7.

My situation:

  • I'm currently running Dify 2.0-beta
  • My server has been compromised - I found cryptominer malware (./hash -o auto.c3pool.org:13333) running, likely exploited through this vulnerability

Questions:
Will there be a security patch for the 2.0-beta branch similar to 1.10.1-fix.1?

Evidence of compromise:

PID    USER  %CPU  TIME+      COMMAND
231474 1001  50.2  292:30.23  ./hash -o auto.c3pool.org:13333 -u 45vWwParN9pJSmRVEd57jH5my5N7Py6Lsi3GqTg+
231456 1001  49.8  292:28.71  ./hash -o auto.c3pool.org:13333 -u 45vWwParN9pJSmRVEd57jH5my5N7Py6Lsi3GqTg+

✔️ Expected Behavior

Security patches should be available for all actively maintained branches including beta versions.

❌ Actual Behavior

  • I'm currently running Dify 2.0-beta
  • My server has been compromised - I found cryptominer malware (./hash -o auto.c3pool.org:13333) running, likely exploited through this vulnerability
Originally created by @nokaquduc on GitHub (Dec 7, 2025). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 2.0-beta.2 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce I noticed that Dify released `1.10.1-fix.1` to address CVE-2025-55182 (React RCE) and CVE-2025-66478 (Next.js), upgrading React to 19.2.1 and Next.js to 15.5.7. **My situation:** - I'm currently running **Dify 2.0-beta** - My server has been **compromised** - I found cryptominer malware (`./hash -o auto.c3pool.org:13333`) running, likely exploited through this vulnerability **Questions:** Will there be a security patch for the 2.0-beta branch similar to 1.10.1-fix.1? **Evidence of compromise:** ``` PID USER %CPU TIME+ COMMAND 231474 1001 50.2 292:30.23 ./hash -o auto.c3pool.org:13333 -u 45vWwParN9pJSmRVEd57jH5my5N7Py6Lsi3GqTg+ 231456 1001 49.8 292:28.71 ./hash -o auto.c3pool.org:13333 -u 45vWwParN9pJSmRVEd57jH5my5N7Py6Lsi3GqTg+ ``` ### ✔️ Expected Behavior Security patches should be available for all actively maintained branches including beta versions. ### ❌ Actual Behavior - I'm currently running **Dify 2.0-beta** - My server has been **compromised** - I found cryptominer malware (`./hash -o auto.c3pool.org:13333`) running, likely exploited through this vulnerability
yindo added the 🐞 bug label 2026-02-21 20:09:21 -05:00
yindo closed this issue 2026-02-21 20:09:21 -05:00
yindo commented 2026-02-21 20:09:22 -05:00
Author
Owner
Copy Link
Copy Source

@nicefuture2016 commented on GitHub (Dec 7, 2025):

same issue

@nicefuture2016 commented on GitHub (Dec 7, 2025): same issue
yindo commented 2026-02-21 20:09:22 -05:00
Author
Owner
Copy Link
Copy Source

@ynckl commented on GitHub (Dec 7, 2025):

同样的问题

@ynckl commented on GitHub (Dec 7, 2025): 同样的问题
yindo commented 2026-02-21 20:09:22 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Dec 7, 2025):

We have already released the fix asap here https://github.com/langgenius/dify/releases/tag/1.10.1-fix.1

Please read the Security Disclosure first before posting an issue.

@crazywoola commented on GitHub (Dec 7, 2025): We have already released the fix asap here https://github.com/langgenius/dify/releases/tag/1.10.1-fix.1 Please read the Security Disclosure first before posting an issue.
yindo commented 2026-02-21 20:09:22 -05:00
Author
Owner
Copy Link
Copy Source

@WolfricWang commented on GitHub (Dec 9, 2025):

Same happened to my self-hosted sever, another processing keep use out my CPU:

Image
@WolfricWang commented on GitHub (Dec 9, 2025): Same happened to my self-hosted sever, another processing keep use out my CPU: <img width="965" height="215" alt="Image" src="https://github.com/user-attachments/assets/6346298c-dd2f-4884-9d98-545be520a69b" />
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#20846
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?