langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-23 04:55:28 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Critical Remote Code Execution (RCE) on Publicly Exposed Dify Instance #21571

New Issue
Closed
opened 2026-02-21 20:13:15 -05:00 by yindo · 3 comments
yindo commented 2026-02-21 20:13:15 -05:00
Owner
Copy Link
Copy Source

Originally created by @123arv on GitHub (Jan 11, 2026).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

https://27.151.84.77:9443/signin next.js 15.5.0

Cloud or Self Hosted

Self Hosted (Source)

Steps to reproduce

<html>

Summary

A critical unauthenticated Remote Code Execution (RCE) vulnerability was identified on a publicly accessible Dify deployment operated by LangGenius.
The issue allows an unauthenticated attacker to execute arbitrary system commands on the server before login, leading to full server compromise.

Affected Product

  • Product: Dify (self-hosted)

  • Component: Web application (Node.js / Next.js)

  • Attack Surface: /signin (unauthenticated)

  • Exposure: Internet-facing IP address

  • Environment: Production (based on environment indicators)

Vulnerability Type

  • Category: Remote Code Execution (RCE)

  • CWE: CWE-94 / CWE-78

  • Severity: Critical

  • Authentication Required: ❌ No

  • User Interaction: ❌ None

Impact

An attacker can:

  • Execute arbitrary OS commands

  • Read application source code

  • Access environment variables

  • Potentially extract:

    • API keys

    • Tokens

    • Database credentials

  • Achieve full server takeover

  • Pivot to internal infrastructure

This results in complete loss of confidentiality, integrity, and availability.

Evidence (from screenshots)

The following was observed without authentication:

  • Arbitrary command execution returning server output

  • File system listing revealing:

    • server.js

    • package.json

    • node_modules

  • Source code disclosure via direct file read

  • Application identified as Next.js App Router

  • Service running in production mode

⚠️ Only minimal proof-of-execution was performed.
No data was modified, exfiltrated, or persisted.

Root Cause (High-Level)

  • Insecure server-side execution path exposed to client-side input

  • Lack of authentication and authorization checks

  • Unsafe handling of user-controlled input reaching command execution

  • Production instance exposed directly to the internet

Attack Scenario

  1. Attacker accesses the public /signin endpoint

  2. Server processes attacker-controlled input unsafely

  3. OS-level commands execute on the backend

  4. Attacker gains full control of the application host

No credentials or special permissions are required.

Severity Justification

Factor | Rating -- | -- Attack Vector | Network Privileges Required | None User Interaction | None Scope | Changed Confidentiality Impact | High Integrity Impact | High Availability Impact | High

Overall Severity: CRITICAL

Recommended Remediation

Immediate actions:

  1. Take the affected instance offline

  2. Rotate all secrets and credentials

  3. Patch or upgrade Dify to a secure version

  4. Remove any debug / testing components from production

  5. Enforce authentication before any server-side execution

  6. Apply strict input validation and command execution controls

  7. Restrict admin interfaces to internal networks

  8. Perform a full compromise assessment

</html>

✔️ Expected Behavior

The /signin endpoint should only display the authentication page

No server-side code execution should be possible from client input

Application source files and system commands should be inaccessible

All backend logic should run only after authentication

Production systems should not expose debugging or execution functionality

❌ Actual Behavior

An unauthenticated user can execute arbitrary system commands

The server returns command output directly in the response

Application files (e.g., server-side JavaScript) can be read remotely

The vulnerability exists before login

This results in full remote code execution on the server

Image Image Image
Originally created by @123arv on GitHub (Jan 11, 2026). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version https://27.151.84.77:9443/signin next.js 15.5.0 ### Cloud or Self Hosted Self Hosted (Source) ### Steps to reproduce <html> <body> <!--StartFragment--><h2 data-start="313" data-end="323">Summary</h2> <p data-start="324" data-end="666">A <strong data-start="326" data-end="382">critical unauthenticated Remote Code Execution (RCE)</strong> vulnerability was identified on a publicly accessible <strong data-start="437" data-end="445">Dify</strong> deployment operated by <strong data-start="469" data-end="510"><span class="hover:entity-accent entity-underline inline cursor-pointer align-baseline"><span class="whitespace-normal">LangGenius</span></span></strong>.<br data-start="511" data-end="514"> The issue allows an unauthenticated attacker to execute arbitrary system commands on the server <strong data-start="610" data-end="626">before login</strong>, leading to <strong data-start="639" data-end="665">full server compromise</strong>.</p> <hr data-start="668" data-end="671"> <h2 data-start="673" data-end="692">Affected Product</h2> <ul data-start="693" data-end="936"> <li data-start="693" data-end="726"> <p data-start="695" data-end="726"><strong data-start="695" data-end="706">Product</strong>: Dify (self-hosted)</p> </li> <li data-start="727" data-end="779"> <p data-start="729" data-end="779"><strong data-start="729" data-end="742">Component</strong>: Web application (Node.js / Next.js)</p> </li> <li data-start="780" data-end="829"> <p data-start="782" data-end="829"><strong data-start="782" data-end="800">Attack Surface</strong>: <code data-start="802" data-end="811">/signin</code> (unauthenticated)</p> </li> <li data-start="830" data-end="872"> <p data-start="832" data-end="872"><strong data-start="832" data-end="844">Exposure</strong>: Internet-facing IP address</p> </li> <li data-start="873" data-end="936"> <p data-start="875" data-end="936"><strong data-start="875" data-end="890">Environment</strong>: Production (based on environment indicators)</p> </li> </ul> <hr data-start="938" data-end="941"> <h2 data-start="943" data-end="964">Vulnerability Type</h2> <ul data-start="965" data-end="1131"> <li data-start="965" data-end="1008"> <p data-start="967" data-end="1008"><strong data-start="967" data-end="979">Category</strong>: Remote Code Execution (RCE)</p> </li> <li data-start="1009" data-end="1035"> <p data-start="1011" data-end="1035"><strong data-start="1011" data-end="1018">CWE</strong>: CWE-94 / CWE-78</p> </li> <li data-start="1036" data-end="1064"> <p data-start="1038" data-end="1064"><strong data-start="1038" data-end="1050">Severity</strong>: <strong data-start="1052" data-end="1064">Critical</strong></p> </li> <li data-start="1065" data-end="1100"> <p data-start="1067" data-end="1100"><strong data-start="1067" data-end="1094">Authentication Required</strong>: ❌ No</p> </li> <li data-start="1101" data-end="1131"> <p data-start="1103" data-end="1131"><strong data-start="1103" data-end="1123">User Interaction</strong>: ❌ None</p> </li> </ul> <hr data-start="1133" data-end="1136"> <h2 data-start="1138" data-end="1147">Impact</h2> <p data-start="1148" data-end="1164">An attacker can:</p> <ul data-start="1166" data-end="1413"> <li data-start="1166" data-end="1201"> <p data-start="1168" data-end="1201">Execute <strong data-start="1176" data-end="1201">arbitrary OS commands</strong></p> </li> <li data-start="1202" data-end="1236"> <p data-start="1204" data-end="1236">Read <strong data-start="1209" data-end="1236">application source code</strong></p> </li> <li data-start="1237" data-end="1271"> <p data-start="1239" data-end="1271">Access <strong data-start="1246" data-end="1271">environment variables</strong></p> </li> <li data-start="1272" data-end="1343"> <p data-start="1274" data-end="1294">Potentially extract:</p> <ul data-start="1297" data-end="1343"> <li data-start="1297" data-end="1307"> <p data-start="1299" data-end="1307">API keys</p> </li> <li data-start="1310" data-end="1318"> <p data-start="1312" data-end="1318">Tokens</p> </li> <li data-start="1321" data-end="1343"> <p data-start="1323" data-end="1343">Database credentials</p> </li> </ul> </li> <li data-start="1344" data-end="1378"> <p data-start="1346" data-end="1378">Achieve <strong data-start="1354" data-end="1378">full server takeover</strong></p> </li> <li data-start="1379" data-end="1413"> <p data-start="1381" data-end="1413">Pivot to internal infrastructure</p> </li> </ul> <p data-start="1415" data-end="1497">This results in <strong data-start="1431" data-end="1496">complete loss of confidentiality, integrity, and availability</strong>.</p> <hr data-start="1499" data-end="1502"> <h2 data-start="1504" data-end="1534">Evidence (from screenshots)</h2> <p data-start="1535" data-end="1589">The following was observed <strong data-start="1562" data-end="1588">without authentication</strong>:</p> <ul data-start="1591" data-end="1869"> <li data-start="1591" data-end="1644"> <p data-start="1593" data-end="1644">Arbitrary command execution returning server output</p> </li> <li data-start="1645" data-end="1731"> <p data-start="1647" data-end="1677">File system listing revealing:</p> <ul data-start="1680" data-end="1731"> <li data-start="1680" data-end="1693"> <p data-start="1682" data-end="1693"><code data-start="1682" data-end="1693">server.js</code></p> </li> <li data-start="1696" data-end="1712"> <p data-start="1698" data-end="1712"><code data-start="1698" data-end="1712">package.json</code></p> </li> <li data-start="1715" data-end="1731"> <p data-start="1717" data-end="1731"><code data-start="1717" data-end="1731">node_modules</code></p> </li> </ul> </li> <li data-start="1732" data-end="1777"> <p data-start="1734" data-end="1777">Source code disclosure via direct file read</p> </li> <li data-start="1778" data-end="1828"> <p data-start="1780" data-end="1828">Application identified as <strong data-start="1806" data-end="1828">Next.js App Router</strong></p> </li> <li data-start="1829" data-end="1869"> <p data-start="1831" data-end="1869">Service running in <strong data-start="1850" data-end="1869">production mode</strong></p> </li> </ul> <blockquote data-start="1871" data-end="1975"> <p data-start="1873" data-end="1975">⚠️ Only minimal proof-of-execution was performed.<br data-start="1922" data-end="1925"> No data was modified, exfiltrated, or persisted.</p> </blockquote> <hr data-start="1977" data-end="1980"> <h2 data-start="1982" data-end="2008">Root Cause (High-Level)</h2> <ul data-start="2009" data-end="2250"> <li data-start="2009" data-end="2075"> <p data-start="2011" data-end="2075">Insecure server-side execution path exposed to client-side input</p> </li> <li data-start="2076" data-end="2125"> <p data-start="2078" data-end="2125">Lack of authentication and authorization checks</p> </li> <li data-start="2126" data-end="2195"> <p data-start="2128" data-end="2195">Unsafe handling of user-controlled input reaching command execution</p> </li> <li data-start="2196" data-end="2250"> <p data-start="2198" data-end="2250">Production instance exposed directly to the internet</p> </li> </ul> <hr data-start="2252" data-end="2255"> <h2 data-start="2257" data-end="2275">Attack Scenario</h2> <ol data-start="2276" data-end="2480"> <li data-start="2276" data-end="2326"> <p data-start="2279" data-end="2326">Attacker accesses the public <code data-start="2308" data-end="2317">/signin</code> endpoint</p> </li> <li data-start="2327" data-end="2381"> <p data-start="2330" data-end="2381">Server processes attacker-controlled input unsafely</p> </li> <li data-start="2382" data-end="2425"> <p data-start="2385" data-end="2425">OS-level commands execute on the backend</p> </li> <li data-start="2426" data-end="2480"> <p data-start="2429" data-end="2480">Attacker gains full control of the application host</p> </li> </ol> <p data-start="2482" data-end="2533">No credentials or special permissions are required.</p> <hr data-start="2535" data-end="2538"> <h2 data-start="2540" data-end="2565">Severity Justification</h2> <div class="TyagGW_tableContainer"><div tabindex="-1" class="group TyagGW_tableWrapper flex flex-col-reverse w-fit"> Factor | Rating -- | -- Attack Vector | Network Privileges Required | None User Interaction | None Scope | Changed Confidentiality Impact | High Integrity Impact | High Availability Impact | High </div></div> <p data-start="2804" data-end="2834"><strong data-start="2804" data-end="2834">Overall Severity: CRITICAL</strong></p> <hr data-start="2836" data-end="2839"> <h2 data-start="2841" data-end="2867">Recommended Remediation</h2> <p data-start="2868" data-end="2886">Immediate actions:</p> <ol data-start="2888" data-end="3286"> <li data-start="2888" data-end="2929"> <p data-start="2891" data-end="2929"><strong data-start="2891" data-end="2929">Take the affected instance offline</strong></p> </li> <li data-start="2930" data-end="2971"> <p data-start="2933" data-end="2971">Rotate <strong data-start="2940" data-end="2971">all secrets and credentials</strong></p> </li> <li data-start="2972" data-end="3016"> <p data-start="2975" data-end="3016">Patch or upgrade Dify to a secure version</p> </li> <li data-start="3017" data-end="3073"> <p data-start="3020" data-end="3073">Remove any debug / testing components from production</p> </li> <li data-start="3074" data-end="3132"> <p data-start="3077" data-end="3132">Enforce authentication before any server-side execution</p> </li> <li data-start="3133" data-end="3196"> <p data-start="3136" data-end="3196">Apply strict input validation and command execution controls</p> </li> <li data-start="3197" data-end="3246"> <p data-start="3200" data-end="3246">Restrict admin interfaces to internal networks</p> </li> <li data-start="3247" data-end="3286"> <p data-start="3250" data-end="3286">Perform a full compromise assessment</p></li></ol><!--EndFragment--> </body> </html> ### ✔️ Expected Behavior The /signin endpoint should only display the authentication page No server-side code execution should be possible from client input Application source files and system commands should be inaccessible All backend logic should run only after authentication Production systems should not expose debugging or execution functionality ### ❌ Actual Behavior An unauthenticated user can execute arbitrary system commands The server returns command output directly in the response Application files (e.g., server-side JavaScript) can be read remotely The vulnerability exists before login This results in full remote code execution on the server <img width="1919" height="1077" alt="Image" src="https://github.com/user-attachments/assets/2d82c18b-2bd7-481b-809f-bb448eb60b14" /> <img width="1919" height="1077" alt="Image" src="https://github.com/user-attachments/assets/dd016120-0b76-495d-8f37-81043f434e45" /> <img width="1919" height="1030" alt="Image" src="https://github.com/user-attachments/assets/3452f7d5-05af-4409-8841-34c94305452d" />
yindo added the 🐞 bug label 2026-02-21 20:13:15 -05:00
yindo closed this issue 2026-02-21 20:13:15 -05:00
yindo commented 2026-02-21 20:13:16 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Jan 11, 2026):

Hi @123arv! I'm Dosu and I’m helping the dify team.

This critical RCE (CVE-2025-55182) in self-hosted Dify (Next.js 15.5.0) is a known, actively exploited vulnerability caused by unsafe deserialization in React Server Components—it's not specific to Dify's backend logic, but rather an upstream issue in React/Next.js. This allows unauthenticated attackers to execute arbitrary commands, read files, and fully compromise the server via endpoints like /signin, even before login. The Dify team has confirmed the issue and strongly recommends all self-hosted users immediately upgrade to v1.11.1 or higher, which includes patched versions of Next.js and React to fully mitigate this and related vulnerabilities (official advisory, details).

If you cannot upgrade right away, take the instance offline, rotate all secrets, restrict network access, and monitor for compromise. Simply updating Docker tags may not be enough—verify you are running the correct, patched images, or build from source if needed (active exploitation and Docker image caveats).

Best practices: always keep dependencies up to date, monitor for security advisories, restrict public access to admin and sensitive endpoints, and never expose development/debug components in production.

Let me know if you need specific upgrade or mitigation steps.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Jan 11, 2026): <!-- Greeting --> Hi @123arv! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the dify team. <!-- Answer --> This critical RCE (CVE-2025-55182) in self-hosted Dify (Next.js 15.5.0) is a known, actively exploited vulnerability caused by unsafe deserialization in React Server Components—it's not specific to Dify's backend logic, but rather an upstream issue in React/Next.js. This allows unauthenticated attackers to execute arbitrary commands, read files, and fully compromise the server via endpoints like /signin, even before login. The Dify team has confirmed the issue and strongly recommends all self-hosted users immediately upgrade to v1.11.1 or higher, which includes patched versions of Next.js and React to fully mitigate this and related vulnerabilities ([official advisory](https://github.com/langgenius/dify/issues/29277), [details](https://github.com/langgenius/dify/issues/29167)). If you cannot upgrade right away, take the instance offline, rotate all secrets, restrict network access, and monitor for compromise. Simply updating Docker tags may not be enough—verify you are running the correct, patched images, or build from source if needed ([active exploitation and Docker image caveats](https://github.com/langgenius/dify/issues/29278)). Best practices: always keep dependencies up to date, monitor for security advisories, restrict public access to admin and sensitive endpoints, and never expose development/debug components in production. Let me know if you need specific upgrade or mitigation steps. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/09c6a130-a272-4b5c-ae37-fafee10c3539?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/09c6a130-a272-4b5c-ae37-fafee10c3539?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/09c6a130-a272-4b5c-ae37-fafee10c3539?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/09c6a130-a272-4b5c-ae37-fafee10c3539?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/09c6a130-a272-4b5c-ae37-fafee10c3539?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/09c6a130-a272-4b5c-ae37-fafee10c3539?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/09c6a130-a272-4b5c-ae37-fafee10c3539?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=This%20critical%20RCE%20%28CVE-2025-55182%29%20in%20self-hosted%20Dify%20%28Next.js%2015.5.0%29%20is%20a%20known%2C%20actively%20exploited%20vulnerability%20caused%20by%20unsafe%20deserialization%20in%20React%20Server%20Components%E2%80%94it%27s%20not%20specific%20to%20Dify%27s%20backend%20logic%2C%20but%20rather%20an%20upstream%20issue%20in%20React/Next.js.%20This%20allows%20unauthenticated%20attackers%20to%20execute%20arbitrary%20commands%2C%20read%20files%2C%20and%20fully%20compromise%20the%20server%20via%20endpoints%20like%20/signin%2C%20even%20before%20login.%20The%20Dify%20team%20has%20confirmed%20the%20issue%20and%20strongly%20recommends%20all%20self-hosted%20users%20immediately%20upgrade%20to%20v1.11.1%20or%20higher%2C%20which%20includes%20patched%20versions%20of%20Next.js%20and%20React%20to%20fully%20mitigate%20this%20and%20related%20vulnerabilities%20%28%5Bofficial%20advisory%5D%28https%3A//github.com/langgenius/dify/issues/29277%29%2C%20%5Bdetails%5D%28https%3A//github.com/langgenius/dify/issues/29167%29%29.%0A%0AIf%20you%20cannot%20upgrade%20right%20away%2C%20take%20the%20instance%20offline%2C%20rotate%20all%20secrets%2C%20restrict%20network%20access%2C%20and%20monitor%20for%20compromise.%20Simply%20updating%20Docker%20tags%20may%20not%20be%20enough%E2%80%94verify%20you%20are%20running%20the%20correct%2C%20patched%20images%2C%20or%20build%20from%20source%20if%20needed%20%28%5Bactive%20exploitation%20and%20Docker%20image%20caveats%5D%28https%3A//github.com/langgenius/dify/issues/29278%29%29.%20%0A%0ABest%20practices%3A%20always%20keep%20dependencies%20up%20to%20date%2C%20monitor%20for%20security%20advisories%2C%20restrict%20public%20access%20to%20admin%20and%20sensitive%20endpoints%2C%20and%20never%20expose%20development/debug%20components%20in%20production.%20%0A%0ALet%20me%20know%20if%20you%20need%20specific%20upgrade%20or%20mitigation%20steps.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/30830)
yindo commented 2026-02-21 20:13:16 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Jan 11, 2026):

See https://github.com/langgenius/dify?tab=readme-ov-file#security-disclosure

@crazywoola commented on GitHub (Jan 11, 2026): See https://github.com/langgenius/dify?tab=readme-ov-file#security-disclosure
yindo commented 2026-02-21 20:13:16 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Jan 11, 2026):

Duplicated https://github.com/langgenius/dify/issues/29277

@crazywoola commented on GitHub (Jan 11, 2026): Duplicated https://github.com/langgenius/dify/issues/29277
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#21571
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?