CVE-2025-0185 Pandas Query Injection in langgenius/dify
Attackers can execute arbitrary code via unsanitized inputs in the Dify Vanna module's Pandas query function.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0185?
CVE-2025-0185 is a high-severity code injection vulnerability in langgenius/dify, published on 20 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version. The vulnerability occurs in the function `vn.get_training_plan_generic(df_information_schema)`, which does not properly sanitize user inputs before executing queries using the Pandas library. This can potentially lead to Remote Code Execution (RCE) if exploited.
Weakness: CWE-94
Which versions are affected by CVE-2025-0185?
It affects 1 product.
Products include Dify Dify.
How do I fix CVE-2025-0185?
No fix has been published for CVE-2025-0185 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-0185 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-0185 exists.
Other vulnerabilities in langgenius/dify
- CVE-2026-41947 Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints
- CVE-2026-41948 Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access
- CVE-2026-61461 Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text
- CVE-2025-67732 Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint
- CVE-2026-41949 Dify < 1.14.2 Authorization Bypass via File Preview Endpoint
Sources
Also known as GHSA-mf57-6hg5-mrvm.