RAGFlow EUVD-2026-33284

The attacker needs (1) network reachability to the RAGFlow web interface, (2) a low-privileged authenticated account - trivially obtained where the default self-registration flow is enabled, which the advisory explicitly calls out, and (3) the ability to create or edit a Canvas workflow that chains a DuckDuckGo component with an LLM component so that attacker-controlled text reaches the Jinja2 prompt renderer in rag/prompts/generator.py. Exploitation is limited where administrators have disabled open registration, restricted Canvas authoring to trusted roles, or fronted the UI with external authentication; affected scope is RAGFlow 0.24.0 and earlier only, and no user interaction by another party is required.

Signals converge on high real-world risk. The CVSS 9.9 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects network reach, low complexity, only low-privileged authentication, no user interaction, and a scope change that yields full CIA impact - consistent with RCE on the host. The PR:L requirement is meaningfully eroded by RAGFlow's typical self-registration model, which the advisory explicitly highlights ('any normal user can register'). EPSS and CISA KEV data are not provided in the input, and no public exploit is identified at time of analysis; however, SSTI in a documented code path with a clear trigger recipe (DuckDuckGo + LLM Canvas chain) is straightforward to weaponize, so absence of public PoC should not lower prioritization. The main caveat: the exact patched version is not stated in the available data and must be confirmed against the GHSA advisory before relying on a fix.

An attacker browses to an internet-exposed RAGFlow instance, self-registers a normal account, and creates a Canvas workflow chaining a DuckDuckGo retrieval component into an LLM component. By embedding a Jinja2 sandbox-escape payload in the prompt or component configuration that reaches rag/prompts/generator.py, the attacker forces template rendering to evaluate Python expressions that invoke os.system, gaining arbitrary command execution as the RAGFlow service account on the underlying host.