CVE-2026-45312 infiniflow CVE debrief

Who should care

Organizations running RAGFlow instances with self-registration enabled or multi-tenant deployments where untrusted users can create Canvas workflows. Security teams responsible for AI/ML infrastructure and RAG pipeline security should prioritize patching and access control reviews.

Technical summary

The RAGFlow open-source RAG engine contains a server-side template injection vulnerability in its prompt generation component (rag/prompts/generator.py). Jinja2 templates are rendered with insufficient input sanitization, allowing template syntax to reach the engine. An authenticated attacker constructs a Canvas workflow combining DuckDuckGo search and LLM components to deliver a payload that escapes template context and executes operating system commands on the host server. The vulnerability requires only low-privilege authenticated access, with no user interaction needed, and the scope change indicates impact beyond the attacker's original security context.

Defensive priority

critical

Recommended defensive actions

• Upgrade RAGFlow to a version newer than 0.24.0 once a patched release is available from the project maintainers
• Restrict or disable self-service user registration until patching is complete to reduce the attack surface from low-privilege authenticated accounts
• Review and restrict Canvas workflow permissions, particularly for components that interact with external search services and LLM chains
• Implement network segmentation to limit RAGFlow server egress and lateral movement opportunities in case of compromise
• Audit existing Canvas workflows for suspicious template syntax or unexpected external command execution indicators
• Apply principle of least privilege to RAGFlow service accounts and container runtime environments
• Monitor for anomalous process spawning from the RAGFlow application context as a detection control for successful exploitation

Evidence notes

Vulnerability description sourced from NVD modified feed and GitHub Security Advisory GHSA-wpg4-h5g2-jxm6. CVSS vector and CWE-1336 attribution confirmed via NVD source item metadata. Attack path details (Canvas workflow, DuckDuckGo+LLM chain, authenticated user registration) derived from official CVE description. Vendor attribution remains unconfirmed in source data ('Unknown Vendor' with review flag).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.