Vulnerability · Published Apr 3, 2026 · Assigned by GitHub_M

CVE-2026-28797RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component

High 8.8

In plain English

A high-severity improper input validation in ragflow from infiniflow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.6%top 51.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow Text Processing (StringTransform) and Message components. These components use Python's jinja2.Template (unsandboxed) to render user-supplied templates, allowing any authenticated user to execute arbitrary operating system commands on the server. At time of publication, there are no publicly available patches.

Affected products (as reported)

Vendor	Product	Versions
infiniflow	ragflow	<= 0.24.0

Weakness: CWE-20, CWE-78, CWE-94, CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/infiniflow/ragflow/security/advisories/GHSA-vvwj-fvwh-4whx x_refsource_CONFIRM