The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service in http-proxy-middleware allows unauthenticated remote attackers to crash the Node.js process by sending HTTP requests to specific paths that trigger an unhandled Promise rejection in the underlying micromatch path-matching library. Affected versions span the 2.x line (before 2.0.7) and the 3.x line (3.0.0 through before 3.0.3). A publicly available proof-of-concept exploit exists, and the CVSS 4.0 vector confirms full availability impact with no privileges or user interaction required, making this straightforward to weaponize against any exposed Node.js service using the middleware.