Executive brief
RAGFlow is an open-source engine used to build AI applications that connect large language models to private data. A security flaw in the system's prompt generator allows any registered user to execute malicious commands on the underlying server. This could lead to a complete system takeover, unauthorized access to sensitive data, or disruption of AI services.
Technical details
A Server-Side Template Injection (SSTI) exists in the citation_prompt() function within rag/prompts/generator.py. The application uses an unsandboxed Jinja2 environment to render user-controlled input extracted from <CITATION_GUIDELINES> XML tags in the LLM component's system prompt. An authenticated attacker can trigger this by creating a Canvas workflow using a DuckDuckGo and LLM component chain. Because the DuckDuckGo component populates retrieval chunks without requiring API keys or embedding models, the vulnerable rendering path is easily reached. Successful exploitation allows for arbitrary remote code execution (RCE) with the privileges of the server process.
Affected products
- infiniflow RAGFlow <= 0.24.0
Timeline
- 2026-05-09: advisory: Original GitHub security advisory published
- 2026-05-29: disclosed: CVE-2026-45312 published to NVD