CVE-2026-45312: RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows any authenticated user to execute arbitrary OS commands on the server. Any normal user can register, create a Canvas workflow with a DuckDuckGo + LLM component chain, and trigger the SSTI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not render user-controlled Jinja2 templates in rag/prompts/generator.py. Disable rendering of templates supplied by untrusted users, or strictly sanitize/escape user-provided template content before any Jinja2 rendering to prevent server-side template injection.
RAGFlow prompt generator (rag/prompts/generator.py) jinja2_template_rendering_for_user_inputs = disabled or sanitized - Configuration
Disable open user registration or restrict which users can register and create Canvas workflows. Limit the ability to create workflows or add DuckDuckGo + LLM component chains to trusted or administrative accounts only, so unprivileged users cannot trigger the SSTI.
Canvas workflows / user registration workflow_creation_and_registration = restricted - Compensating control
If immediate code changes are not possible, restrict access to the Canvas workflow creation and prompt-generation endpoints (e.g., via network ACLs, WAF rules, or requiring admin approval) to trusted IPs or accounts to prevent untrusted users from exercising the vulnerable flow (DuckDuckGo + LLM component chain).
- Operational
Investigate logs for signs of exploitation related to prompt rendering or Canvas workflows. If compromise is suspected, perform incident response (containment, eradication, recovery) such as removing malicious artifacts and rotating any credentials or keys that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45312?
The severity of CVE-2026-45312 is critical with a CVSS score of 9.9.
How do I fix CVE-2026-45312?
To fix CVE-2026-45312, upgrade RAGFlow to version 0.25.0 or later where the vulnerability is addressed.
What are the risks associated with CVE-2026-45312?
CVE-2026-45312 poses risks including remote code execution, which allows authenticated users to execute arbitrary OS commands on the server.
Who is affected by CVE-2026-45312?
Any user with authenticated access to RAGFlow version 0.24.0 and earlier is affected by CVE-2026-45312.
What components are vulnerable in CVE-2026-45312?
The vulnerable component in CVE-2026-45312 is the prompt generator located at rag/prompts/generator.py in RAGFlow.