Executive brief
RAGFlow, an open-source RAG (Retrieval-Augmented Generation) engine, is vulnerable to a security flaw where malicious code can be embedded in agent pipeline names. An attacker with workspace access can create a specially named agent that, when viewed by another user, executes unauthorized scripts in their browser. This could lead to the theft of login tokens or full account takeover of other team members within the same workspace.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in RAGFlow versions prior to 0.26.3. The vulnerability stems from insufficient sanitization of agent pipeline (DSL) node names. While the backend 'normalize_dsl' function validates JSON serialization, it preserves node names verbatim. The frontend 'dataflow-result' UI subsequently renders these names in a "Rerun from current step" confirmation modal using 'dangerouslySetInnerHTML' with 'escapeValue: false' in the i18next configuration. An authenticated attacker can inject a malicious payload into a node name that executes when another user interacts with the rerun modal. The fix, introduced in version 0.26.3, implements DOMPurify sanitization on the interpolated HTML content before rendering.
Affected products
- infiniflow RAGFlow before 0.26.3
Timeline
- 2026-06-30: disclosed: Issue reported on GitHub
- 2026-07-01: patched: Fix merged into main branch
- 2026-07-02: advisory: CVE published and version 0.26.3 released
References
- https://github.com/infiniflow/ragflow/commit/572f1ea9f4eba6a60e64f7437dee60aa1c0913f1
- https://github.com/infiniflow/ragflow/issues/16507
- https://github.com/infiniflow/ragflow/pull/16516
- https://github.com/infiniflow/ragflow/releases/tag/v0.26.3
- https://www.vulncheck.com/advisories/ragflow-stored-cross-site-scripting-via-agent-pipeline-node-name