Vulnerabilidades de Infiniflow
CVEs publicadas que afetam produtos de Infiniflow: 6 registro(s), com severidade, exploração e correções.
CVE-2026-58579
Média · 5.4
CWE-79 02/07/2026
RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name
RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl, which only performs JSON serialization validation and preserves the node name verbatim. The dataflow-result web UI then renders that name into the "Rerun from current step" confirmation modal via dangerouslySetInnerHTML, and the i18next configuration sets escapeValue:false, so the value is inserted into the DOM without HTML encoding. An authenticated workspace user who can create or edit an agent can inject arbitrary JavaScript that executes in the session of another workspace member who opens the dataflow result and clicks rerun, enabling session/token theft and account takeover across the user trust boundary.
CVE-2026-45312
Crítica · 9.9
CWE-1336 29/05/2026
RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows any authenticated user to execute arbitrary OS commands on the server. Any normal user can register, create a Canvas workflow with a DuckDuckGo + LLM component chain, and trigger the SSTI.
CVE-2026-28797
Alta · 8.8
CWE-20 03/04/2026
RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow Text Processing (StringTransform) and Message components. These components use Python's jinja2.Template (unsandboxed) to render user-supplied templates, allowing any authenticated user to execute arbitrary operating system commands on the server. At time of publication, there are no publicly available patches.
CVE-2026-24770
Crítica · 9.8
CWE-22 27/01/2026
Path traversal Zip Slip no parser MinerU do Infiniflow RAGFlow (CVE-2026-24770)
O RAGFlow é um mecanismo de código aberto para RAG (Retrieval-Augmented Generation). Na versão 0.23.1 e possivelmente em versões anteriores, o parser MinerU contém uma vulnerabilidade "Zip Slip" que permite a um atacante sobrescrever arquivos arbitrários no servidor (levando a Remote Code Execution) por meio de um arquivo ZIP malicioso. A classe MinerUParser obtém e extrai arquivos ZIP de uma fonte externa (mineru_server_url). A lógica de extração em `_extract_zip_no_root` não sanitiza os nomes de arquivos dentro do arquivo ZIP. O commit 64c75d558e4a17a4a48953b4c201526431d8338f contém um patch para o problema.
CVE-2025-69286
Crítica · 9.8
CWE-340 31/12/2025
RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutually derivable. Specifically, both tokens are generated using the same `URLSafeTimedSerializer` with predictable inputs, enabling an unauthorized user who obtains the shared assistant/agent URL to derive the personal API key. This grants them full control over the assistant/agent owner's account. Version 0.22.0 fixes the issue.
CVE-2025-68700
Alta · 8.8
CWE-78 31/12/2025
RAGFlow Remote Code Execution Vulnerability
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.23.0, a low-privileged authenticated user (normal login account) can execute arbitrary system commands on the server host process via the frontend Canvas CodeExec component, completely bypassing sandbox isolation. This occurs because untrusted data (stdout) is parsed using eval() with no filtering or sandboxing. The intended design was to "automatically convert string results into Python objects," but this effectively executes attacker-controlled code. Additional endpoints lack access control or contain inverted permission logic, significantly expanding the attack surface and enabling chained exploitation. Version 0.23.0 contains a patch for the issue.