# CVE-2025-68700: RAGFlow remote code execution in CodeExec component

Source: https://junglewise.ai/threats/cve-2025-68700-ragflow-remote-code-execution-in-codeexec-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-68700 · Severity: high · CVSS 8.8 · Published 2025-12-31

RAGFlow is an open-source retrieval-augmented generation (RAG) platform used for knowledge base and AI applications. A low-privileged authenticated user can execute arbitrary system commands on the server by submitting malicious code to the Canvas CodeExec component, bypassing sandbox protections and gaining full control of the host system. This affects all versions prior to 0.23.0.

Technologies: [InfiniFlow RAGFlow](https://junglewise.ai/threats/technologies/ragflow). Vendors: [InfiniFlow](https://junglewise.ai/threats/vendors/infiniflow).

## Quick answers

**Is CVE-2025-68700 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-68700 being exploited in the wild.

**How severe is CVE-2025-68700?** High severity, with a CVSS score of 8.8, published 31 December 2025.

**Which products and versions are affected?** InfiniFlow RAGFlow prior to 0.23.0.

**Is there a fix for CVE-2025-68700?** A patch was published on 2025-11-25: Version 0.23.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-68700 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-68700?** Check whether you run InfiniFlow RAGFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in agent/tools/code_exec.py where untrusted stdout output from a sandboxed execution environment is directly passed to Python's eval() function with no filtering or validation. An authenticated attacker can craft a CodeExec node that prints a Python expression designed to execute arbitrary code; when eval() processes this expression, it executes on the host process with full privileges. The root cause is the use of eval() for automatic type conversion without proper input sanitization. The attack requires prior authentication and network access to the RAGFlow frontend, but no additional user interaction beyond node execution. The patch in version 0.23.0 replaces unsafe eval() usage with safe deserialization methods like json.loads().

## Affected products

- Infiniflow RAGFlow prior to 0.23.0

## Timeline

- 2025-12-31: disclosed
- 2025-11-25: patched: Version 0.23.0 released with fix
- 2025-11-25: other: Fix commit 7a344a32f9f83529e12ca12f40f2657eb79fe811 merged to main

## References

- [https://github.com/infiniflow/ragflow/commit/7a344a32f9f83529e12ca12f40f2657eb79fe811](https://github.com/infiniflow/ragflow/commit/7a344a32f9f83529e12ca12f40f2657eb79fe811)
- [https://github.com/infiniflow/ragflow/security/advisories/GHSA-8xw3-v6c2-j84j](https://github.com/infiniflow/ragflow/security/advisories/GHSA-8xw3-v6c2-j84j)

## Related threats

- [RAGFlow server-side request forgery in LLM API key endpoint](https://junglewise.ai/threats/cve-2026-49951-ragflow-before-0-27-0-contains-a-server-side-request-forgery)
- [InfiniFlow RAGFlow server-side request forgery in Seafile Connector](https://junglewise.ai/threats/cve-2026-121927-a-vulnerability-has-been-found-in-infiniflow-ragflow-up-to-0-27)
- [InfiniFlow RAGFlow authorization bypass in Text To SQL Retrieval](https://junglewise.ai/threats/cve-2026-121585-a-security-flaw-has-been-discovered-in-infiniflow-ragflow-up-to)
- [RAGFlow authorization bypass in OpenAI-compatible agent completion](https://junglewise.ai/threats/cve-2026-119337-ragflow-is-an-open-source-rag-retrieval-augmented-generation)
- [RAGFlow improper access control in get_dataset API endpoint](https://junglewise.ai/threats/cve-2026-51897-ragflow-0-24-0-contains-improper-access-control-in-get-dataset)