Which versions of Python are affected by CVE-2026-28797?

RAGFlow versions 0.24.0 and earlier contain a server-side template injection flaw that allows authenticated internal users to execute arbitrary operating system commands and compromise affected…

How to fix or mitigate CVE-2026-28797?

Within 24 hours: Identify all RAGFlow 0.24.0 and earlier deployments and document current user access lists for agent workflow components. Within 7 days: Restrict agent workflow creation and editing permissions to only essential personnel; disable or isolate RAGFlow instances that process sensitive data until patching is available. Within 30 days: Establish monitoring for suspicious template syntax in agent configurations and contact vendor for patch timeline; evaluate migration to alternative workflow platforms if patch timeline exceeds organizational risk tolerance.

Python CVE-2026-28797

Q: What is the CVSS score of CVE-2026-28797?

CVE-2026-28797 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-18876 HIGH

Improper Input Validation (CWE-20)

2026-04-03 GitHub_M

Code Injection Python

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 16:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 03, 2026 - 22:15 euvd

EUVD-2026-18876

Analysis Generated

Apr 03, 2026 - 22:15 vuln.today

CVE Published

Apr 03, 2026 - 21:41 nvd

HIGH 8.7

DescriptionGitHub Advisory

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow Text Processing (StringTransform) and Message components. These components use Python's jinja2.Template (unsandboxed) to render user-supplied templates, allowing any authenticated user to execute arbitrary operating system commands on the server. At time of publication, there are no publicly available patches.

AnalysisAI

Server-Side Template Injection in RAGFlow 0.24.0 and earlier allows authenticated users to execute arbitrary OS commands via unsandboxed Jinja2 template rendering in Agent workflow components. The vulnerability affects the Text Processing (StringTransform) and Message components, where user-supplied templates are processed without sandboxing. With a CVSS 8.7 score and low attack complexity (AC:L), authenticated attackers can achieve full system compromise remotely. No public exploit identified at time of analysis, and no vendor-released patch available as of publication date.

Technical ContextAI

RAGFlow is an open-source Retrieval-Augmented Generation engine (cpe:2.3:a:infiniflow:ragflow) that processes user queries using AI-powered document retrieval workflows. The vulnerability stems from unsafe use of Python's jinja2.Template class in the Agent workflow's StringTransform and Message components. Jinja2 is a powerful templating engine commonly used in Python web applications, but when used without sandboxing (specifically, without jinja2.sandbox.SandboxedEnvironment), it allows template authors to access Python internals and execute arbitrary code. The root cause is classified as CWE-20 (Improper Input Validation), though this more specifically represents a template injection vulnerability where user-controlled template content is rendered without sanitization. Authenticated users can craft malicious Jinja2 templates containing Python code that executes in the server context, bypassing application-level security controls entirely.

RemediationAI

No vendor-released patch identified at time of analysis according to the published advisory. Organizations should immediately review access controls and restrict RAGFlow usage to fully trusted users only until a fix becomes available. Monitor the official GitHub Security Advisory at https://github.com/infiniflow/ragflow/security/advisories/GHSA-vvwj-fvwh-4whx for patch announcements and subscribe to the infiniflow/ragflow repository release notifications. As an interim mitigation, consider disabling or restricting access to the Agent workflow's Text Processing (StringTransform) and Message components if business requirements permit. Implement network segmentation to isolate RAGFlow servers from critical infrastructure and sensitive data stores. Enhanced monitoring for unusual process execution, outbound network connections, or file system modifications from RAGFlow server processes can provide early detection of exploitation attempts. If the application architecture permits, consider running RAGFlow in containerized environments with restricted capabilities and read-only file systems to limit post-exploitation impact. Review authentication logs for suspicious account activity and enforce strong authentication mechanisms to raise the barrier for initial access.