EUVD-2026-41421
GHSA-73vg-2j49-cmcr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered stored XSS requires low-privilege authentication (PR:L) and victim interaction (UI:R); scope change (S:C) reflects cross-user session hijack with no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl, which only performs JSON serialization validation and preserves the node name verbatim. The dataflow-result web UI then renders that name into the "Rerun from current step" confirmation modal via dangerouslySetInnerHTML, and the i18next configuration sets escapeValue:false, so the value is inserted into the DOM without HTML encoding. An authenticated workspace user who can create or edit an agent can inject arbitrary JavaScript that executes in the session of another workspace member who opens the dataflow result and clicks rerun, enabling session/token theft and account takeover across the user trust boundary.
AnalysisAI
Stored XSS in RAGFlow before 0.26.3 enables cross-user JavaScript execution through unsanitized agent pipeline node names rendered in a confirmation modal. An authenticated workspace member injects a payload into a DSL node name via the agent update endpoint; when a different workspace member opens the dataflow result and clicks 'Rerun from current step,' the payload executes in their browser, enabling session token theft and account takeover across the workspace trust boundary. No CISA KEV listing exists, but a public proof-of-concept is available and a vendor patch has been released as v0.26.3.
Technical ContextAI
RAGFlow is an open-source Retrieval-Augmented Generation pipeline orchestration platform by InfiniFlow (CPE: cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), arising from two compounding failures. On the backend, the agent update endpoint's normalize_dsl function performs only JSON serialization validation and preserves DSL node names verbatim with no HTML encoding. On the frontend, the React-based dataflow-result UI renders those names directly via React's dangerouslySetInnerHTML API, and the i18next internationalization library is configured with escapeValue:false, disabling its default HTML-escaping safety net. The combination eliminates both the server-side and client-side sanitization layers, creating a complete stored XSS sink triggered through the 'Rerun from current step' confirmation modal.
RemediationAI
Upgrade RAGFlow to version v0.26.3 or later, which resolves the vulnerability via commit 572f1ea9f4eba6a60e64f7437dee60aa1c0913f1 merged through PR #16516 (https://github.com/infiniflow/ragflow/pull/16516); the release is available at https://github.com/infiniflow/ragflow/releases/tag/v0.26.3. If immediate upgrade is not feasible, restrict agent pipeline create and edit permissions to fully trusted workspace members only, since the attack originates exclusively from a user with those privileges - note this limits collaborative pipeline authoring workflows as a trade-off. Completely disabling the agent pipeline feature for untrusted users eliminates the injection vector entirely but removes RAGFlow's core orchestration functionality for those users.
A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. Rated critical severity (CVSS 9
Path traversal vulnerability in RAGFlow RAG engine version 0.23.1 allows unauthenticated attackers to read arbitrary fil
In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Rated high severity (CVSS 8.9), this vulnerabilit
The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulne
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. Rated high s
A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. Rated high severity (CVS
RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents
A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data query
Server-side template injection in RAGFlow 0.24.0 and earlier allows any authenticated user to execute arbitrary operatin
An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowl
Server-Side Template Injection in RAGFlow 0.24.0 and earlier allows authenticated users to execute arbitrary OS commands
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today