EUVD-2026-33284CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows any authenticated user to execute arbitrary OS commands on the server. Any normal user can register, create a Canvas workflow with a DuckDuckGo + LLM component chain, and trigger the SSTI.
AnalysisAI
Server-side template injection in RAGFlow 0.24.0 and earlier allows any authenticated user to execute arbitrary operating system commands on the host through the Jinja2-based prompt generator (rag/prompts/generator.py). Because RAGFlow installations commonly permit open self-registration, the practical barrier is minimal: an attacker registers an account, builds a Canvas workflow chaining a DuckDuckGo retrieval node with an LLM node, and triggers the SSTI to break out of the Jinja2 sandbox. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker needs (1) network reachability to the RAGFlow web interface, (2) a low-privileged authenticated account - trivially obtained where the default self-registration flow is enabled, which the advisory explicitly calls out, and (3) the ability to create or edit a Canvas workflow that chains a DuckDuckGo component with an LLM component so that attacker-controlled text reaches the Jinja2 prompt renderer in rag/prompts/generator.py. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals converge on high real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker browses to an internet-exposed RAGFlow instance, self-registers a normal account, and creates a Canvas workflow chaining a DuckDuckGo retrieval component into an LLM component. By embedding a Jinja2 sandbox-escape payload in the prompt or component configuration that reaches rag/prompts/generator.py, the attacker forces template rendering to evaluate Python expressions that invoke os.system, gaining arbitrary command execution as the RAGFlow service account on the underlying host. |
| Remediation | Patch available per vendor advisory GHSA-wpg4-h5g2-jxm6 (https://github.com/infiniflow/ragflow/security/advisories/GHSA-wpg4-h5g2-jxm6); upgrade to the fixed release identified there as soon as it is confirmed (the input data does not enumerate the exact fix version, so verify against the advisory before deploying). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all RAGFlow deployments; disable account self-registration; restrict network access to RAGFlow interfaces to trusted systems only; assess whether temporary service shutdown is operationally acceptable. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Remote code execution in Tautulli versions prior to 2.17.1 allows attackers to achieve unauthenticated RCE on fresh inst
Server-side template injection in Jupyter Enterprise Gateway versions 2.0.0rc2 through 3.2.x allows remote attackers to
Share
External POC / Exploit Code
Leaving vuln.today