RAGFlow versions 0.24.0 and earlier contain a server-side template injection (SSTI) vulnerability in the prompt generator (rag/prompts/generator.py) that leverages improper neutralization of special elements in Jinja2 templates. Authenticated users can exploit this by creating a Canvas workflow with a DuckDuckGo + LLM component chain, triggering arbitrary OS command execution on the server. This vulnerability is tracked as CWE-1336 and has a CVSS 3.1 base score of 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vendor has not provided a patch or official remediation at this time.

Successful exploitation allows any authenticated user to execute arbitrary operating system commands on the server hosting RAGFlow, potentially leading to full system compromise. This impacts confidentiality, integrity, and availability of the affected system. Since any normal user can register and exploit this, the attack surface is broad within environments where RAGFlow is deployed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user registration and workflow creation privileges to trusted users only. Monitor for suspicious activity related to workflow creation and command execution. Avoid exposing the vulnerable versions of RAGFlow to untrusted networks.