Threats tagged 'ghsa-qhwq-2pgm-vq8j'

A security flaw in InfiniFlow RAGFlow up to versions 0.27.2 and 1.0.0-rc2 affects the RunSQL function in the internal/engine/infinity/sql.go file. The vulnerability involves manipulation of the tableName/kbIDs arguments, leading to an authorization bypass. This flaw can be exploited remotely. Public exploit code has been released. The CVSS score is 4.3, indicating a medium severity impact.