CVE-2026-28797: RAGFlow SSTI Remote Code Execution Flaw

CVE-2026-28797 Overview

CVE-2026-28797 is a Server-Side Template Injection (SSTI) vulnerability affecting RAGFlow, an open-source Retrieval-Augmented Generation (RAG) engine. The vulnerability exists in RAGFlow's Agent workflow components, specifically the Text Processing (StringTransform) and Message components. These components utilize Python's jinja2.Template without sandboxing to render user-supplied templates, enabling any authenticated user to execute arbitrary operating system commands on the server.

Critical Impact

Authenticated attackers can achieve full remote code execution on servers running RAGFlow versions 0.24.0 and prior through malicious Jinja2 template injection, potentially leading to complete system compromise.

Affected Products

• RAGFlow version 0.24.0 and all prior versions
• RAGFlow Agent workflow Text Processing (StringTransform) component
• RAGFlow Agent workflow Message component

Discovery Timeline

• 2026-04-03 - CVE-2026-28797 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-28797

Vulnerability Analysis

This vulnerability represents a classic Server-Side Template Injection (SSTI) flaw stemming from the unsafe use of Jinja2 templating in RAGFlow's Agent workflow components. Jinja2 is a powerful Python templating engine that, when used without proper sandboxing, allows template authors to access Python objects and execute arbitrary code.

The Text Processing (StringTransform) and Message components in RAGFlow accept user-controlled template strings and pass them directly to jinja2.Template() for rendering. Since no sandboxing or input restrictions are applied, an authenticated attacker can craft malicious templates that leverage Jinja2's introspection capabilities to escape the template context and execute system commands.

The attack can be performed by any authenticated user, meaning that even low-privileged accounts can exploit this vulnerability to achieve remote code execution with the privileges of the RAGFlow server process.

Root Cause

The root cause of this vulnerability is the use of Python's unsandboxed jinja2.Template class to render user-supplied template strings. The vulnerable components fail to implement Jinja2's SandboxedEnvironment or other security controls that would restrict template capabilities. This allows attackers to use Jinja2's template syntax to traverse Python's object hierarchy and access dangerous functions like os.system(), subprocess.Popen(), or other code execution primitives.

Attack Vector

The attack is network-based and requires only low-privilege authentication to the RAGFlow application. An attacker must authenticate to the RAGFlow instance and then interact with either the Text Processing (StringTransform) or Message components within the Agent workflow functionality. By submitting a specially crafted Jinja2 template containing Python object introspection and method calls, the attacker can break out of the template sandbox and execute arbitrary operating system commands.

Typical SSTI payloads leverage Jinja2's ability to access Python's __class__, __mro__, __subclasses__, and __globals__ attributes to traverse the object hierarchy and locate dangerous classes or functions. Once located, these can be invoked to execute system commands or read sensitive files from the server.

The vulnerability mechanism involves injecting malicious Jinja2 template syntax that exploits Python's object introspection capabilities. Attackers typically traverse from string objects through __class__.__mro__ to locate base classes, then use __subclasses__() to find classes with file system or command execution capabilities. For detailed technical analysis, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-28797

Indicators of Compromise

• Unusual template syntax patterns in Agent workflow inputs containing Python introspection attributes such as __class__, __mro__, __subclasses__, or __globals__
• Web application logs showing requests to Agent workflow endpoints with encoded or obfuscated template payloads
• Unexpected child processes spawned by the RAGFlow server process
• System command execution logs showing commands initiated by the RAGFlow application user account

Detection Strategies

• Implement web application firewall (WAF) rules to detect common SSTI payload patterns in HTTP requests, particularly those containing Jinja2 template syntax with Python introspection keywords
• Monitor RAGFlow application logs for template rendering errors or exceptions that may indicate exploitation attempts
• Deploy endpoint detection and response (EDR) solutions to identify anomalous process execution chains originating from the RAGFlow server process
• Configure intrusion detection systems (IDS) to alert on network traffic containing SSTI-related patterns

Monitoring Recommendations

• Enable verbose logging for the RAGFlow Agent workflow components to capture all user-supplied template inputs
• Implement real-time alerting for any template processing that includes suspicious patterns like {{, {%, combined with Python dunder methods
• Monitor system process creation events for unexpected command execution by the RAGFlow application service account
• Review authentication logs for unusual access patterns to Agent workflow functionality

How to Mitigate CVE-2026-28797

Immediate Actions Required

• Restrict network access to RAGFlow instances to trusted users and networks only until a patch is available
• Implement application-level input validation to block template strings containing dangerous patterns such as __class__, __mro__, __subclasses__, and __globals__
• Consider disabling the Agent workflow Text Processing (StringTransform) and Message components if they are not essential to operations
• Review authentication logs and audit user accounts with access to Agent workflow functionality

Patch Information

At the time of publication, there are no publicly available patches for this vulnerability. Organizations should monitor the RAGFlow GitHub repository for security updates and apply patches immediately when they become available.

Workarounds

• Deploy a web application firewall (WAF) with rules specifically designed to block Jinja2 SSTI payloads targeting the Agent workflow endpoints
• Implement network segmentation to isolate RAGFlow instances from critical infrastructure and limit the blast radius of potential compromise
• Apply the principle of least privilege by restricting access to Agent workflow features to only users who require this functionality
• Consider running RAGFlow in a containerized environment with restricted capabilities to limit the impact of successful exploitation

# Example: Network isolation using iptables
# Restrict access to RAGFlow service port to trusted networks only
iptables -A INPUT -p tcp --dport 9380 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 9380 -j DROP