Threats affecting pkg:github/ragent

ragent versions 1.0.0 through 1.1.0 have a missing authorization vulnerability in the RagTraceController. This flaw allows any authenticated user to access and view all users' RAG traces, including sensitive details such as usernames, user IDs, conversation IDs, questions, and execution details for each node. The vulnerability enables unauthorized data exposure by paging through specific endpoints.

ragent version 1.1.0 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users can upload SVG files with embedded scripts via the knowledge base document upload endpoint. When other users view these SVG files served inline, the malicious scripts execute in the context of the application, potentially leading to account takeover.