CVE-2026-58579
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
An XSS vulnerability in RAGFlow before 0.26.3 allows an authenticated user to inject arbitrary JavaScript via the agent pipeline (DSL) node name. The code executes in the session of another workspace member who opens the dataflow result and clicks the rerun button.
Risk Assessment
An attacker can steal session tokens and take over another user's account, breaking the trust boundary between users and potentially leading to unauthorized data access.
Recommendation
Upgrade RAGFlow to version 0.26.3 or later immediately and check for signs of exploitation in the production environment.
Other vulnerabilities in RAGFlow
See all- CVE-2026-75898High
RAGFlow before version 0.26.3 has a server-side request forgery vulnerability in the agent workflow Invoke component. The component builds an outbound request URL from canvas configuration and template variables and passes it to requests.get/post/put without safety validation, allowing access to internal network resources.
- CVE-2026-45312Critical
RAGFlow 0.24.0 and earlier contain a Jinja2 template injection vulnerability in the prompt generator (rag/prompts/generator.py). This allows any authenticated user to execute arbitrary OS commands on the server.
- CVE-2026-24770Critical
RAGFlow is an open-source RAG engine. In version 0.23.1 and possibly earlier, the MinerU parser contains a 'Zip Slip' vulnerability, allowing an attacker to overwrite arbitrary files on the server (leading to Remote Code Execution) via a malicious ZIP archive. The MinerUParser class retrieves and extracts ZIP files from an external source (mineru_server_url). The extraction logic in `_extract_zip_no_root` fails to sanitize filenames within the ZIP archive. Commit 64c75d558e4a17a4a48953b4c201526431d8338f contains a patch.
- CVE-2026-28797High
RAGFlow versions up to 0.24.0 contain a Server-Side Template Injection (SSTI) vulnerability in the TextProcessing and Message components. It allows an authenticated user to execute arbitrary OS commands on the server via unsafe Jinja2 template rendering.
Original NVD description (English source)
RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl, which only performs JSON serialization validation and preserves the node name verbatim. The dataflow-result web UI then renders that name into the "Rerun from current step" confirmation modal via dangerouslySetInnerHTML, and the i18next configuration sets escapeValue:false, so the value is inserted into the DOM without HTML encoding. An authenticated workspace user who can create or edit an agent can inject arbitrary JavaScript that executes in the session of another workspace member who opens the dataflow result and clicks rerun, enabling session/token theft and account takeover across the user trust boundary.