RAGFlow CVE-2025-68700

Requires an authenticated low-privilege ('normal login') RAGFlow account and use of the frontend Canvas CodeExec component, whose backend parses sandbox stdout with eval() (agent/tools/code_exec.py). Exploitation is limited to RAGFlow versions prior to 0.23.0; 0.23.0 patches it by replacing eval() with json.loads/ast.literal_eval. No user interaction beyond the attacker's own session is needed (UI:N), and the flaw bypasses the intended sandbox isolation. Additional endpoints with missing access control or inverted permission logic widen the attack surface and enable chaining, but the core RCE only needs a valid account plus reachability of the Canvas/CodeExec feature.

This is a genuine high-priority issue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with full VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H, base 8.6) describes network-reachable, low-complexity, low-privilege command execution that escapes the sandbox into the host process - a scope-crossing full-triad compromise. The E:P (Proof-of-Concept) exploit-maturity metric aligns with the multi-source 'POC publicly available' signal, and the exploit reference is the vendor's own GitHub Security Advisory (GHSA-8xw3-v6c2-j84j), so the code path is well-documented and reproducible. The confirming CWE-78 (OS command injection) label is slightly imprecise: the root cause per the description and patch diff is untrusted stdout passed to Python eval(), i.e. code injection (closer to CWE-94), though the practical outcome - arbitrary system commands on the host - matches the command-injection framing. No EPSS score and no CISA KEV listing are provided, so there is no evidence of active mass exploitation; combined with the low real-world deployment footprint, this reads as a serious but not yet widely-weaponized flaw. Net: patch urgently where RAGFlow is deployed, but the absence of KEV/EPSS means risk is exposure-driven rather than campaign-driven.

An attacker who holds any normal RAGFlow login account builds or triggers a Canvas workflow using the CodeExec component; because the component parses the sandbox's stdout with eval(), the attacker crafts output that eval() executes as Python in the host process, escaping sandbox isolation to run arbitrary OS commands on the server. Publicly available exploit details exist in the vendor GitHub Security Advisory, and additional endpoints with missing or inverted access-control logic let the attacker chain further actions.