CVE-2026-45312: RAGFlow Jinja2 SSTI RCE Vulnerability

CVE-2026-45312 Overview

CVE-2026-45312 is a Server-Side Template Injection (SSTI) vulnerability in RAGFlow, an open-source Retrieval-Augmented Generation (RAG) engine. The flaw resides in the prompt generator module rag/prompts/generator.py and affects versions 0.24.0 and earlier. Any authenticated user can exploit the Jinja2 template processor to execute arbitrary operating system commands on the host. Exploitation requires only a low-privileged account, which can be obtained through normal self-registration. An attacker registers an account, builds a Canvas workflow that chains a DuckDuckGo search component with a large language model (LLM) component, and triggers template rendering to achieve remote code execution.

Critical Impact

Authenticated low-privilege users can execute arbitrary OS commands on the RAGFlow server, leading to full host compromise and data exfiltration.

Affected Products

• RAGFlow 0.24.0
• RAGFlow versions prior to 0.24.0
• Deployments exposing user registration and Canvas workflow features

Discovery Timeline

• 2026-05-29 - CVE-2026-45312 published to NVD
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-45312

Vulnerability Analysis

The vulnerability is a Jinja2 Server-Side Template Injection categorized under [CWE-1336] (Improper Neutralization of Special Elements Used in a Template Engine). RAGFlow's prompt generator renders user-influenced strings through Jinja2 without restricting access to dangerous attributes. Jinja2's sandbox is not enforced, allowing template expressions to traverse Python object internals and reach os.system, subprocess.Popen, or equivalent primitives. Because the prompt rendering is performed server-side as part of the Canvas workflow pipeline, command execution occurs in the context of the RAGFlow service account.

Root Cause

The root cause is the use of an unsandboxed Jinja2 Environment in rag/prompts/generator.py combined with the inclusion of attacker-controlled content inside template strings. User input flowing through workflow components such as DuckDuckGo search results and LLM prompt fields is interpolated into templates that are then rendered. Template expressions of the form {{ ... }} are evaluated rather than treated as literal text.

Attack Vector

The attack is network-reachable and requires only a standard authenticated account. The exploitation chain is:

1. The attacker registers a new RAGFlow user account.
2. The attacker creates a Canvas workflow containing a DuckDuckGo component feeding into an LLM component.
3. The attacker submits input containing a Jinja2 payload that accesses Python built-ins through object traversal (for example, __class__.__mro__ and __subclasses__).
4. The prompt generator renders the payload, invoking arbitrary OS commands on the server.

No verified public proof-of-concept is referenced in the advisory. See the GitHub Security Advisory GHSA-wpg4-h5g2-jxm6 for technical details.

Detection Methods for CVE-2026-45312

Indicators of Compromise

• Unexpected child processes spawned by the RAGFlow Python process, such as sh, bash, curl, wget, or python -c.
• Outbound network connections from the RAGFlow host to unfamiliar domains or IP addresses immediately after workflow execution.
• New user registrations followed shortly by Canvas workflow creation and execution from the same account.
• Workflow inputs or LLM prompts containing Jinja2 traversal patterns such as {{, __class__, __mro__, __subclasses__, or __globals__.

Detection Strategies

• Inspect RAGFlow application logs for prompt content containing Jinja2 control sequences submitted through Canvas components.
• Monitor process lineage on RAGFlow servers to detect command interpreters launched as children of the application runtime.
• Correlate authentication events for newly registered accounts with workflow creation and execution APIs within short time windows.

Monitoring Recommendations

• Alert on file modifications under RAGFlow data directories and on creation of files in /tmp or web-accessible paths by the application user.
• Capture and retain HTTP request bodies to Canvas and prompt endpoints for retrospective hunting on template injection patterns.
• Track egress traffic from RAGFlow hosts and baseline expected destinations to surface command-and-control or data exfiltration attempts.

How to Mitigate CVE-2026-45312

Immediate Actions Required

• Upgrade RAGFlow to a release later than 0.24.0 that contains the fix once available from the maintainers.
• Disable open user self-registration on internet-exposed RAGFlow instances until patched.
• Restrict network access to the RAGFlow web interface using a reverse proxy, VPN, or IP allow-listing.
• Review existing user accounts and Canvas workflows for unauthorized entries created before patching.

Patch Information

Refer to the RAGFlow GitHub Security Advisory GHSA-wpg4-h5g2-jxm6 for the official fix, affected commits, and upgrade guidance. The fix must replace the unsandboxed Jinja2 environment in rag/prompts/generator.py with a SandboxedEnvironment or strip template syntax from user-controlled input.

Workarounds

• Run RAGFlow inside a hardened container with a read-only filesystem, no shell binaries, and a dedicated non-root service account.
• Apply egress firewall rules that deny outbound traffic from the RAGFlow host to anything outside required model and search endpoints.
• Remove or disable the DuckDuckGo and LLM Canvas components for untrusted users until the upgrade is applied.
• Place a web application firewall in front of RAGFlow with rules that block request bodies containing Jinja2 traversal tokens such as __class__ or __subclasses__.