Pandas Query Injection in langgenius/dify

The Pandas Query Injection vulnerability in Dify Tools Vanna presents a significant security risk. An attacker can craft malicious input that, when processed by the vn.gettrainingplan_generic function, results in the execution of arbitrary code through the Pandas library. This could lead to complete system compromise, including data exfiltration, modification, or deletion. The blast radius extends to any data processed by the Vanna module, potentially impacting sensitive training data or configurations. Successful exploitation could resemble attacks leveraging similar query injection vulnerabilities in other data processing tools, allowing for unauthorized access and control.

Organizations utilizing Dify Tools Vanna for data processing and training, particularly those deploying it in production environments or handling sensitive data, are at risk. Specifically, those relying on the default configuration without implementing additional input validation measures are most vulnerable.

• python / server:

import pandas as pd
# Check for suspicious query patterns in user input before passing to Pandas
user_input = input("Enter your query:")
if "--" in user_input or "@" in user_input:
    print("Invalid query detected.")
else:
    df = pd.DataFrame({'col1': [1, 2], 'col2': [3, 4]})
    query = user_input
    result = df.query(query)
    print(result)

• generic web: Monitor access logs for requests containing unusual query parameters or patterns that could indicate an attempted injection attack.

1. 2025-03-20Disclosure

   disclosure

1. Gereserveerd2025-01-02
2. Gepubliceerd2025-03-20
3. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2025-0185 is to upgrade to a patched version of Dify Tools Vanna as soon as it becomes available. Until a patch is released, consider implementing input validation and sanitization measures within the vn.gettrainingplan_generic function to prevent malicious queries from being executed. Restrict access to the Vanna module to trusted users and systems. Monitor system logs for unusual activity related to Pandas queries. While a WAF may not directly address this vulnerability, it can help detect and block suspicious query patterns. The Dify Tools team is expected to release a patch shortly.