CVE-2026-28797
Published: 03 April 2026
Description
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow Text Processing (StringTransform) and Message components. These components use Python's jinja2.Template (unsandboxed) to render user-supplied templates,…
more
allowing any authenticated user to execute arbitrary operating system commands on the server. At time of publication, there are no publicly available patches.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the improper input validation (CWE-20) by requiring validation of user-supplied templates to prevent SSTI exploitation leading to OS command injection in RAGFlow's StringTransform and Message components.
Mandates identification, reporting, and timely remediation of the SSTI flaw in RAGFlow v0.24.0 and prior, including applying patches when available to eliminate the vulnerability.
Enforces least privilege on the RAGFlow server process and authenticated user accounts, limiting the scope and impact of arbitrary OS commands executed via SSTI.
Security SummaryAI
CVE-2026-28797 is a Server-Side Template Injection (SSTI) vulnerability in RAGFlow, an open-source Retrieval-Augmented Generation (RAG) engine. It affects versions 0.24.0 and prior, specifically in the Agent workflow's Text Processing (StringTransform) and Message components. These components render user-supplied templates using Python's unsandboxed jinja2.Template, enabling template injection that leads to arbitrary operating system command execution on the server. The vulnerability is associated with CWEs-20 (Improper Input Validation), CWE-78 (OS Command Injection), CWE-94 (Code Injection), and CWE-1336 (Incorrect Handling of Shared Resources), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Any authenticated user can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants attackers the ability to execute arbitrary OS commands on the affected server, potentially leading to full system compromise, data theft, or further lateral movement, given the high impact on confidentiality, integrity, and availability.
The GitHub security advisory (GHSA-vvwj-fvwh-4whx) confirms that, at the time of publication, no publicly available patches exist for this issue.
As a RAG engine, RAGFlow has relevance to AI/ML deployments, where open-source tools for retrieval-augmented generation are commonly used in production environments handling sensitive data. No real-world exploitation has been reported in available information.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSTI in network-accessible Python/Jinja2 web app directly enables remote exploitation of public-facing application (T1190) leading to arbitrary OS command execution via Python interpreter (T1059.006) and Unix shell (T1059.004).