# CVE-2026-58579: infiniflow RAGFlow stored XSS in agent pipeline node name

Source: https://junglewise.ai/threats/cve-2026-58579-infiniflow-ragflow-stored-xss-in-agent-pipeline-node-name  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-58579 · Severity: medium · CVSS 5.4 · Published 2026-07-02

RAGFlow, an open-source RAG (Retrieval-Augmented Generation) engine, is vulnerable to a security flaw where malicious code can be embedded in agent pipeline names. An attacker with workspace access can create a specially named agent that, when viewed by another user, executes unauthorized scripts in their browser. This could lead to the theft of login tokens or full account takeover of other team members within the same workspace.

Technologies: [InfiniFlow RAGFlow](https://junglewise.ai/threats/technologies/ragflow). Vendors: [InfiniFlow](https://junglewise.ai/threats/vendors/infiniflow).

## Quick answers

**Is CVE-2026-58579 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58579 being exploited in the wild.

**How severe is CVE-2026-58579?** Medium severity, with a CVSS score of 5.4, published 2 July 2026.

**Which products and versions are affected?** InfiniFlow RAGFlow before 0.26.3.

**Is there a fix for CVE-2026-58579?** A patch was published on 2026-07-01: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58579 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-58579?** Check whether you run InfiniFlow RAGFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in RAGFlow versions prior to 0.26.3. The vulnerability stems from insufficient sanitization of agent pipeline (DSL) node names. While the backend 'normalize_dsl' function validates JSON serialization, it preserves node names verbatim. The frontend 'dataflow-result' UI subsequently renders these names in a "Rerun from current step" confirmation modal using 'dangerouslySetInnerHTML' with 'escapeValue: false' in the i18next configuration. An authenticated attacker can inject a malicious payload into a node name that executes when another user interacts with the rerun modal. The fix, introduced in version 0.26.3, implements DOMPurify sanitization on the interpolated HTML content before rendering.

## Affected products

- infiniflow RAGFlow before 0.26.3

## Timeline

- 2026-06-30: disclosed: Issue reported on GitHub
- 2026-07-01: patched: Fix merged into main branch
- 2026-07-02: advisory: CVE published and version 0.26.3 released

## References

- [https://github.com/infiniflow/ragflow/commit/572f1ea9f4eba6a60e64f7437dee60aa1c0913f1](https://github.com/infiniflow/ragflow/commit/572f1ea9f4eba6a60e64f7437dee60aa1c0913f1)
- [https://github.com/infiniflow/ragflow/issues/16507](https://github.com/infiniflow/ragflow/issues/16507)
- [https://github.com/infiniflow/ragflow/pull/16516](https://github.com/infiniflow/ragflow/pull/16516)
- [https://github.com/infiniflow/ragflow/releases/tag/v0.26.3](https://github.com/infiniflow/ragflow/releases/tag/v0.26.3)
- [https://www.vulncheck.com/advisories/ragflow-stored-cross-site-scripting-via-agent-pipeline-node-name](https://www.vulncheck.com/advisories/ragflow-stored-cross-site-scripting-via-agent-pipeline-node-name)

## Related threats

- [RAGFlow server-side request forgery in LLM API key endpoint](https://junglewise.ai/threats/cve-2026-49951-ragflow-before-0-27-0-contains-a-server-side-request-forgery)
- [InfiniFlow RAGFlow server-side request forgery in Seafile Connector](https://junglewise.ai/threats/cve-2026-121927-a-vulnerability-has-been-found-in-infiniflow-ragflow-up-to-0-27)
- [InfiniFlow RAGFlow authorization bypass in Text To SQL Retrieval](https://junglewise.ai/threats/cve-2026-121585-a-security-flaw-has-been-discovered-in-infiniflow-ragflow-up-to)
- [RAGFlow authorization bypass in OpenAI-compatible agent completion](https://junglewise.ai/threats/cve-2026-119337-ragflow-is-an-open-source-rag-retrieval-augmented-generation)
- [RAGFlow improper access control in get_dataset API endpoint](https://junglewise.ai/threats/cve-2026-51897-ragflow-0-24-0-contains-improper-access-control-in-get-dataset)