What is the CVSS score of CVE-2026-45312?

CVE-2026-45312 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of RAGFlow are affected by CVE-2026-45312?

RAGFlow versions 0.24.0 and earlier contain a critical server-side template injection vulnerability allowing authenticated users to execute arbitrary operating system commands on the hosting…

How to fix or mitigate CVE-2026-45312?

Within 24 hours: Identify all RAGFlow deployments; disable account self-registration; restrict network access to RAGFlow interfaces to trusted systems only; assess whether temporary service shutdown is operationally acceptable. Within 7 days: Implement network segmentation to isolate RAGFlow hosts from sensitive systems; deploy command execution monitoring with alerting; review access logs for exploitation indicators. Within 30 days: Maintain interim mitigations; monitor vendor advisories for patch release; prepare and test upgrade procedures for immediate deployment when patch becomes available.

RAGFlow CVE-2026-45312

EUVD-2026-33284 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-05-29 GitHub_M

Ssti Code Injection Ragflow

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 13:20 vuln.today

DescriptionCVE.org

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows any authenticated user to execute arbitrary OS commands on the server. Any normal user can register, create a Canvas workflow with a DuckDuckGo + LLM component chain, and trigger the SSTI.

AnalysisAI

Server-side template injection in RAGFlow 0.24.0 and earlier allows any authenticated user to execute arbitrary operating system commands on the host through the Jinja2-based prompt generator (rag/prompts/generator.py). Because RAGFlow installations commonly permit open self-registration, the practical barrier is minimal: an attacker registers an account, builds a Canvas workflow chaining a DuckDuckGo retrieval node with an LLM node, and triggers the SSTI to break out of the Jinja2 sandbox. No public exploit identified at time of analysis, but the vendor security advisory describes the chain explicitly.

Technical ContextAI

RAGFlow (cpe:2.3:a:infiniflow:ragflow) is an open-source Retrieval-Augmented Generation engine that lets users compose 'Canvas' pipelines combining retrieval tools (e.g., DuckDuckGo) with LLM components. Prompts assembled for these components flow through a Jinja2 template renderer in rag/prompts/generator.py. The flaw maps to CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), the classic SSTI class where untrusted input reaches a templating engine that exposes Python object internals - allowing template expressions such as attribute traversal through __class__, __mro__, and __subclasses__ to reach os.system, subprocess.Popen, or similar primitives and achieve OS command execution under the RAGFlow service account.

RemediationAI

Patch available per vendor advisory GHSA-wpg4-h5g2-jxm6 (https://github.com/infiniflow/ragflow/security/advisories/GHSA-wpg4-h5g2-jxm6); upgrade to the fixed release identified there as soon as it is confirmed (the input data does not enumerate the exact fix version, so verify against the advisory before deploying). Until upgrade is possible, disable open user self-registration to remove the trivial-PR:L path, restrict Canvas workflow creation to trusted administrators, and place the RAGFlow web interface behind an authenticating reverse proxy or VPN to remove unauthenticated reachability - note that disabling registration breaks multi-tenant onboarding and restricting Canvas authoring breaks legitimate prompt engineering work. As a containment measure, run the RAGFlow service under a non-root, sandboxed user with seccomp/AppArmor and outbound egress filtering so that a successful SSTI yields the least-privileged shell possible.