CVE Tools
Sign in

CVE-2026-45312

RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution

Published: May 29, 2026Updated: Jul 21, 2026 Sources: CVE List NVDCWE-1336
9.9CRITICAL
NVD MITRE
EPSS Score
0.4%
Top 62.5%
CISA KEV
Not in KEV
Exploits
No Known Exploits
Remediation
No Fix Available
Self-Check
Not available

Description

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows any authenticated user to execute arbitrary OS commands on the server. Any normal user can register, create a Canvas workflow with a DuckDuckGo + LLM component chain, and trigger the SSTI.

In plain language

AI Act now

CVE-2026-45312 is a serious bug in RAGFlow (versions 0.24.0 and earlier) that can let a normal logged-in user run commands on your server; if you use RAGFlow with any user accounts that can create or trigger prompt/Canvas workflows, you should treat this as an urgent fix—even though a public patch isn’t available.

Executive summary

In RAGFlow (ragflow) versions 0.24.0 and earlier, a Server-Side Template Injection in the prompt generator (Jinja2 prompt handling) can be triggered by an authenticated user via prompt/Canvas workflow creation and execution, leading to Remote Code Execution on the server; exploitation is reported with actor Qilin and is driving rising press attention.

If affected, business impact
Full server compromiseData theft from the serverService disruption or shutdownMalicious actions under your account

What to do now

  1. Check which RAGFlow version you run (and confirm whether it is 0.24.0 or earlier).
  2. If you are on 0.24.0 or earlier, assume risk if you have any user accounts beyond a fully trusted admin (because a normal authenticated user can trigger the bug).
  3. Immediately restrict access to RAGFlow: limit who can log in, and disable or strongly restrict features that let users create/trigger Canvas workflows and prompt generator steps.
  4. If you can’t upgrade (no fixed version is provided), isolate the RAGFlow server from the rest of your network and limit inbound access to only the IPs/users who need it.
  5. Collect and review server logs for evidence of suspicious template/prompt activity and unexpected process execution around the time of any suspicious logins or workflow runs.
May need vendor / contractor work

CVSS Vector Breakdown

AV:NAC:LPR:LUI:NS:CC:HI:HA:H
Exploitability
AV:NAttack Vector
Network
AC:LAttack Complexity
Low
PR:LPrivileges Required
Low
UI:NUser Interaction
None
Scope
S:CScope
Changed
Impact
C:HConfidentiality
High
I:HIntegrity
High
A:HAvailability
High
Open in CVSS calculator →

Weaknesses

CWE-1336

Affected Products

infiniflow
commercialaka infiniflow/ragflow, ragflow
ragflowMixed
AI / ML / vector-db-rag

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.
Is your org exposed to CVE-2026-45312?We can run the check for you — a free external exposure review, no install. Check my exposure

References

https://github.com/infiniflow/ragflow/security/advisories/GHSA-wpg4-h5g2-jxm6
github.com
News mentions
1

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-45312 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows