RAGFlow, an open-source Retrieval-Augmented Generation engine, suffers from a Server-Side Template Injection vulnerability in versions up to 0.24.0. The vulnerability arises because the Agent workflow's Text Processing (StringTransform) and Message components render user-supplied templates using Python's jinja2.Template in an unsandboxed manner. This improper input validation allows authenticated users to execute arbitrary OS commands on the server hosting RAGFlow. The CVSS 4.0 base score is 8.7, reflecting network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability. No vendor patches or mitigations are currently available.

Successful exploitation allows any authenticated user to execute arbitrary operating system commands on the server running RAGFlow. This can lead to full compromise of the server, including unauthorized data access, modification, or service disruption. The vulnerability affects confidentiality, integrity, and availability of the affected system. No known exploits are reported in the wild at this time.

At the time of this report, no official patches or fixes are available for this vulnerability. Users should avoid deploying vulnerable versions (0.24.0 and earlier) in production environments. Restrict access to authenticated users only and monitor for suspicious activity. Follow the vendor's advisory for updates and apply patches promptly once they become available.