CVE-2026-45312 Details
Description
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows any authenticated user to execute arbitrary OS commands on the server. Any normal user can register, create a Canvas workflow with a DuckDuckGo + LLM component chain, and trigger the SSTI.
A server-side template injection vulnerability has been identified in RAGFlow versions through 0.24.0. This issue allows any authenticated user to execute arbitrary operating system commands on the server. The vulnerability arises in the prompt generator component, where user-controlled input is rendered through an unsandboxed Jinja2 environment. Exploitation can be achieved by creating a Canvas workflow that includes a malicious payload in the citation guidelines, which is then processed by the application, leading to command execution on the server.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 29, 2026CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/infiniflow/ragflow/security/advisories/GHSA-wpg4-h5g2-jxm6 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/infiniflow/ragflow/security/advisories/GHSA-wpg4-h5g2-jxm6 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| infiniflow RAGFlow | <= 0.24.0 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | New CVE Received | [email protected] |