Executive brief
RAGFlow is an open-source retrieval-augmented generation (RAG) platform used for knowledge base and AI applications. A low-privileged authenticated user can execute arbitrary system commands on the server by submitting malicious code to the Canvas CodeExec component, bypassing sandbox protections and gaining full control of the host system. This affects all versions prior to 0.23.0.
Technical details
The vulnerability exists in agent/tools/code_exec.py where untrusted stdout output from a sandboxed execution environment is directly passed to Python's eval() function with no filtering or validation. An authenticated attacker can craft a CodeExec node that prints a Python expression designed to execute arbitrary code; when eval() processes this expression, it executes on the host process with full privileges. The root cause is the use of eval() for automatic type conversion without proper input sanitization. The attack requires prior authentication and network access to the RAGFlow frontend, but no additional user interaction beyond node execution. The patch in version 0.23.0 replaces unsafe eval() usage with safe deserialization methods like json.loads().
Affected products
- Infiniflow RAGFlow prior to 0.23.0
Timeline
- 2025-12-31: disclosed
- 2025-11-25: patched: Version 0.23.0 released with fix
- 2025-11-25: other: Fix commit 7a344a32f9f83529e12ca12f40f2657eb79fe811 merged to main