RAGFlow EUVD-2026-41421

The attacker must hold a valid RAGFlow account with workspace membership and permission to create or edit agent pipelines - unauthenticated exploitation is not possible. The victim must be a member of the same workspace, navigate to the dataflow result view for the compromised agent, and click the 'Rerun from current step' button to trigger the vulnerable modal. Both the dangerouslySetInnerHTML rendering path and the i18next escapeValue:false configuration must be present, which are confirmed defaults in RAGFlow builds before v0.26.3. Exploitation is strictly intra-workspace; users in separate workspaces are not reachable through this vector. The required victim click action (UI:P) is the primary limiting factor for mass exploitation.

The CVSS 4.0 score of 5.1 (Medium) appropriately reflects the dual constraints of PR:L (authenticated attacker) and UI:P (victim must interact with the modal), which together limit opportunistic mass exploitation. Impact metrics are correctly scoped to the subsequent system (SC:L/SI:L/SA:N), capturing the cross-user trust-boundary nature: the attacker's own session incurs no risk, but peer workspace members' sessions are targetable. A publicly available proof-of-concept (GitHub issue #16507, tagged 'exploit') lowers the attacker skill threshold materially, yet the absence of a CISA KEV listing indicates no confirmed widespread exploitation at time of analysis. Real-world risk is highest in multi-tenant or collaborative RAGFlow deployments where workspace membership is shared among users of differing trust levels. For single-user or tightly access-controlled deployments, risk is substantially reduced by the authenticated prerequisite. No EPSS data was provided in the source intelligence, so probability-based exploitation likelihood cannot be independently quantified here.

A malicious RAGFlow workspace member crafts an agent pipeline and sets a DSL node name to a JavaScript payload designed to exfiltrate the victim's session token or API key. When a co-worker opens the dataflow result view for that agent and clicks the 'Rerun from current step' button, the confirmation modal renders the node name unsanitized via dangerouslySetInnerHTML, executing the payload in the victim's browser and transmitting their credentials to the attacker. A public proof-of-concept demonstrating this full flow is available at https://github.com/infiniflow/ragflow/issues/16507.