High severity8.8NVD Advisory· Published Apr 3, 2026· Updated Apr 22, 2026
CVE-2026-28797
CVE-2026-28797
Description
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow Text Processing (StringTransform) and Message components. These components use Python's jinja2.Template (unsandboxed) to render user-supplied templates, allowing any authenticated user to execute arbitrary operating system commands on the server. At time of publication, there are no publicly available patches.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:*range: <=0.24.0
- (no CPE)range: <=0.24.0
Patches
Vulnerability mechanics
References
1- github.com/infiniflow/ragflow/security/advisories/GHSA-vvwj-fvwh-4whxnvdExploitMitigationVendor Advisory
News mentions
0No linked articles in our index yet.