Executive brief
RAGFlow is an open-source engine used to build AI applications that connect large language models to private data. A security flaw allows any registered user to execute malicious commands on the server by submitting specially crafted text templates through the 'Agent' workflow feature. This could lead to a total system takeover, including the theft of sensitive documents, database credentials, and API keys.
Technical details
A Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow 'Text Processing' (StringTransform) and 'Message' components. The root cause is the use of Python's unsandboxed 'jinja2.Template' class to render user-supplied strings from the 'Script' and 'Content' fields. An authenticated attacker can bypass the simple '{{' check and use Jinja2 globals (e.g., cycler or namespace) to access the 'os' module and execute arbitrary shell commands. This allows for full remote code execution (RCE) with the privileges of the application process. As of the advisory date, no official patches are available, though migrating to Jinja2's 'SandboxedEnvironment' is the recommended mitigation.
Affected products
- Infiniflow RAGFlow <= 0.24.0
Timeline
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-03: disclosed: NVD publication date