Read the docs
TI-2026-42163 Aliases CVE-2026-58579GHSA-73vg-2j49-cmcr

RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name

Priority MEDIUM 56CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl, which only performs JSON serialization validation and preserves the node name verbatim. The dataflow-result web UI then renders that name into the "Rerun from current step" confirmation modal via dangerouslySetInnerHTML, and the i18next configuration sets escapeValue:false, so the value is inserted into the DOM without HTML encoding. An authenticated workspace user who can create or edit an agent can inject arbitrary JavaScript that executes in the session of another workspace member who opens the dataflow result and clicks rerun, enabling session/token theft and account takeover across the user trust boundary.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00298 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed ragflow (infiniflow): 0.26.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
infiniflowragflowbefore 0.26.30.26.3Patch availableCNA
  • ragflow Vendorinfiniflow Affected before 0.26.3 Fixed in 0.26.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:*——infiniflow
  • cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:* Versions — — ·infiniflow

Remediation

  • Fix · CNA ragflow (infiniflow) Fixed in 0.26.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-58579
  2. 2026-10-03 Alias added: GHSA-73vg-2j49-cmcr

References

Exploit 1

Patch 2

Other 1

  • TI-2026-19971 RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser CVSS 3.1CRITICAL 9.8
  • TI-2025-30545 Missing brute-force protection in infiniflow RAGFlow CVSS 3.1CRITICAL 9.8
  • TI-2024-11535 Remote Code Execution in infiniflow/ragflow CVSS 3.0CRITICAL 9.8
  • TI-2025-42731 RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability CVSS 4.0HIGH 8.9
  • TI-2025-19992 RAGFlow SQL Injection vulnerability CVSS 4.0HIGH 8.9
  • TI-2026-33111 RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution CVSS 3.1CRITICAL 9.9
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences